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WASTE, FRAUD AND ABUSE: A CONTINUING 
THREAT TO MEDICARE AND MEDICAID 


WEDNESDAY, MARCH 2, 2011 

House of Representatives, 

Subcommittee on Oversight and Investigations, 

Committee on Energy and Commerce, 

Washington, DC. 

The subcommittee met, pursuant to call, at 10:02 a.m., in room 
2322 of the Rayburn House Office Building, Hon. Cliff Stearns 
(chairman of the subcommittee) presiding. 

Members present: Representatives Stearns, Terry, Myrick, Mur- 
phy, Burgess, Bilbray, Gingrey, Scalise, Gardner, Griffith, Barton, 
DeGette, Schakowsky, Gonzalez, Dingell and Waxman (ex officio). 

Staff present: Stacy Cline, Counsel, Oversight/Investigations; 
Todd Harrison, Chief Counsel, Oversight/Investigations; Sean 
Hayes, Counsel, Oversight/Investigations; Debbee Keller, Press 
Secretary; Peter Kielty, Senior Legislative Analyst; Carly 
McWilliams, Legislative Clerk; Andrew Powaleny, Press Assistant; 
Krista Rosenthall, Counsel to Chairman Emeritus; Ruth Saunders, 
Detailee, ICE; Alan Slobodin, Chief Investigative Counsel, Over- 
sight; Sam Specter, Counsel, Oversight/Investigations; John Stone, 
Associate Counsel, Oversight/Investigations; Kristin Amerling, 
Democratic Chief Counsel and Oversight Staff Director; Phil 
Barnett, Democratic Staff Director; Brian Cohen, Democratic Inves- 
tigations Staff Director and Senior Policy Advisor; Karen Lightfoot, 
Democratic Communications Director and Senior Policy Advisor; 
Ali Neubauer, Democratic Investigator; and Anne Tindall, Demo- 
cratic Counsel. 

Mr. Stearns. Good morning, everybody, and let me welcome ev- 
erybody to the Subcommittee on Oversight and Investigations of 
Energy and Commerce. 

OPENING STATEMENT OF HON. CLIFF STEARNS, A REP- 
RESENTATIVE IN CONGRESS FROM THE STATE OF FLORIDA 

Mr. Stearns. We convene this hearing of the Subcommittee on 
Oversight and Investigations today to examine the efforts of the 
Department of Health and Human Services and the Centers for 
Medicare and Medicaid Services to address fraud, waste and abuse 
in the Medicare and Medicaid programs. 

This issue is of great importance to us. During this Congress and 
the last, I introduced the Medicare Eraud Prevention Act, which 
would increase the criminal penalties for those convicted of de- 
frauding the Medicare program. As a Member of Congress from 
Elorida, I have personally seen how this issue can greatly impact 
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my State and its citizens. During my town hall meetings last week, 
many of my constituents shared their concerns with stories about 
waste, fraud and abuse in Medicare. 

Recently, the Government Accountability Office listed the Medi- 
care and Medicaid programs as “high risk.” High-risk programs are 
identified as having greater vulnerability to fraud, waste and abuse 
and mismanagement. As much as $60 billion is lost to Medicare 
fraud every year. This is an estimate because the exact number is 
unknown. When my staff asked the folks from CMS how much 
fraud was being carried out, they had no idea. 

So it is hardly news that the Medicare and Medicaid programs 
are at high risk. GAO has listed Medicare as high risk since 1990 
and Medicaid as high risk since 2003. Over the years, this com- 
mittee has had countless hearings on this subject and yet nothing 
seems to change. The volume of Medicare fraud and the cor- 
responding cost to the taxpayer continues to go up and up. 

Meanwhile, the stories we hear from States like Florida continue 
to horrify taxpayers. News reports have indicated that Medicare 
fraud is rapidly eclipsing the drug trade as Florida’s most profit- 
able and efficient criminal enterprise. With Medicare fraud, the 
penalties are lower and the threat of violence is nonexistent. Mean- 
while, seniors who notice that their Medicare number is being used 
for fraudulent schemes often find themselves begging the govern- 
ment to do anything about it, often with no results. 

The types of fraud we are seeing run the gamut from fraudulent 
billing schemes to the actual creation of fake storefronts to sell du- 
rable medical equipment and then bill it to Medicare. Once the 
criminals get their money from Medicare, they close up shop and 
open a new storefront in a new location and start the scam all over 
again. 

The Administration says that additional measures are being put 
in place to screen Medicare providers and suppliers, and halt pay- 
ments when there are credible allegations of fraud. These are good 
and these are necessary steps to take, but only if they work, and 
GAO has said that there is much more work to be done. 

In 2014, the Administration’s health care bill will implement 
massive changes. Medicare will be cut and Medicaid will expand. 
According to the Chief Actuary of Medicare and Medicaid, 20 mil- 
lion people will be dumped onto the Medicaid rolls and $575 billion 
will be cut from Medicare. While we are all committed to repealing 
this onerous law on this side, we also must do our best to end fraud 
before 2014. If we can’t stop fraud now, how are we going to do so 
while simultaneously adding 20 million people to Medicaid? 

We have to make sure that the focus remains on preventing 
fraud and abuse. Unfortunately, CMS uses a pay first, check later 
system. That must change. We need to check first, and pay later 
before taxpayers’ funds are wasted. CMS needs to fix its 
verification system to prevent these kinds of crimes or we will 
never get a handle on this problem. 

Every dollar that is lost to fraud is one that is not spent on med- 
ical care for those in need. Fraud raises the costs of health care for 
all Americans. Since Obamacare will raise those costs even further, 
it is absolutely necessary that we get a handle on Medicare and 
Medicaid fraud. 
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So I look forward to hearing what the Federal Government is 
doing to get Medicare and Medicaid fraud and abuse under control. 
[The prepared statement of Mr. Stearns follows:] 

Prepared Statement of Hon. Cliff Stearns 

We convene this hearing of the Suhcommittee on Oversight and Investigations 
today to examine the efforts of the Department of Health and Human Services and 
the Centers for Medicare and Medicaid to address fraud, waste, and abuse in the 
Medicare and Medicaid programs. 

This issue is of great importance to me-during this Congress and the last I intro- 
duced the “Medicare Fraud Prevention Act”, which would increase the criminal pen- 
alties for those convicted of defrauding the Medicare program. As a Representative 
from Florida, I have personally seen how this issue can greatly impact my State and 
its citizens. 

Recently the Government Accountability Office (GAO) listed the Medicare and 
Medicaid programs in its “High Risk” report. High risk programs are identified as 
such due to their “greater vulnerability to fraud, waste, abuse, and mismanage- 
ment.” Indeed, as much as $60 billion is lost to Medicare fraud every year. This is 
a massive amount of fraud, although apparently the exact number is not even 
known. Recently, when my staff asked the folks from the Center for Medicare and 
Medicaid Services how much fraud was being carried out, CMS had no idea. 

It is hardly news that the Medicare and Medicaid programs are at high risk for 
fraud, waste, abuse, and mismanagement. GAO has listed these programs as high 
risk for over 20 years, beginning in 1990. Congress’ interest in Medicare fraud and 
abuse isn’t new either. Over the years, this Committee has had countless hearings 
on the subject. And yet, nothing seems to change. The volume of Medicare fraud, 
and the corresponding cost to the taxpayers, continues to go up and up and up. 
President Obama has repeatedly promised that he would somehow SAVE taxpayer 
money and fund health care reform by eliminating Medicare fraud, but in the last 
two years, under his watch. Medicare has remained on the GAO’s list as a “high 
risk” program for fraud. Estimates of fraud remain in the $60 billion a year range, 
despite President Obama’s commitment to fight Medicare fraud. 

Meanwhile, the stories we hear from States like Florida continue to horrify honest 
taxpayers. News reports have indicated that Medicare fraud is rapidly eclipsing the 
drug trade as Florida’s most profitable and efficient criminal enterprise. The pen- 
alties are lower and the threat of violence is nonexistent. Meanwhile, honest seniors 
who notice that their Medicare number is being used for fraudulent schemes often 
find themselves begging the government to do anything about it, often with no re- 
sults. 

The types of fraud we are seeing run the gamut from fraudulent billing schemes 
to the actual creation of fake store-fronts to allegedly sell durable medical equip- 
ment and bill it to Medicare. Once the criminals get their money from Medicare, 
they close up shop and open a new store-front in a new location, and start the scam 
all over again. 

Now the Administration says that additional measures are being put in place to 
screen Medicare providers and suppliers, and halt payments when there are credible 
allegations of fraud. I agree that these are good — and necessary — steps to take, as- 
suming that they work. 

Yet, GAO found that there is still much more that can be done in both Medicare 
and Medicaid. Considering that Obamacare puts the federal government on the 
hook for 90 percent of these increased costs to Medicaid alone, I sincerely hope we 
move to do more to combat fraud sooner rather than later. 

In 2014 massive changes will take place because of Obamacare. Medicare will face 
drastic cuts and Medicaid will drastically expand. According to the Chief Actuary 
of Medicare and Medicaid, 20 million people will be dumped onto Medicaid rolls 
while $675 billion will be cut from Medicare. While we are committed to repealing 
this onerous law, we also must do our best to end fraud before 2014. 

If we can’t stop fraud now, how are we going to do so while simultaneously adding 
20 million people to Medicaid? 

I hope the witnesses at today’s hearing will help us understand the challenges 
CMS will face as it prepares for the full implementation of health care reform, and 
how it plans to combat fraud and waste in the system. 

We have to make sure that the focus remains on preventing fraud and abuse be- 
fore it takes place. If CMS is not setting up the right systems and checks to prevent 
these kinds of crimes, we are never going to get a handle on this problem. 
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Every dollar that is lost to fraud is one that is not spent on medical care for those 
who need it. Fraud raises the costs of health care in America, and since I believe 
that Obamacare will raise those costs even further, it is absolutely necessary that 
we put and end to Medicare and Medicaid fraud. 

I look forward to the testimony of the witnesses today and learning what the fed- 
eral government is thinking of doing to get Medicare and Medicaid fraud and abuse 
under control. 

Mr. Stearns. My remaining 1 minute I will give to the gen- 
tleman from Texas, Mr. Barton. 

Mr. Barton. Thank you, Mr. Chairman. 

OPENING STATEMENT OF HON. JOE BARTON, A 
REPRESENTATIVE IN CONGRESS FROM THE STATE OF TEXAS 

Mr. Barton. The easiest thing in Washington to do is talk about 
waste, fraud and abuse and the hardest thing in Washington to do 
is to actually do something about it. As Chairman Stearns just 
said, on both sides of the aisle we have had numerous hearings 
about waste, fraud and abuse in Medicare and Medicaid and yet 
the problem still obviously persists. We can’t even get a direct an- 
swer as to what the scope of the problem is. It is an $800 billion 
combined program. Is it 10 percent? Ten percent would be $80 bil- 
lion a year. Is it 5 percent? That would be $40 billion. Is it 1 per- 
cent? That would be $8 billion. Nobody knows. 

Mr. Chairman, I hope on a bipartisan basis this subcommittee 
and the full committee under your leadership and under the lead- 
ership of Ranking Member Waxman and Chairman Upton in this 
Congress actually do something about it. With a $1.5 trillion budg- 
et deficit annually, there is no question that money spent here will 
be money that we get a huge return on investment. 

I look forward to hearing from our witnesses and I hope that 
they have some solutions in addition to helping us define the scope 
of the problem. 

With that, Mr. Chairman, I yield back. 

[The prepared statement of Mr. Barton follows:] 

Prepared Statement of Hon. Joe Barton 

Thank you Mr. Chairman for holding this hearing in an attempt to discuss, ex- 
pose, and potentially prevent wide-spread waste, fraud, and abuse in the Medicare 
and Medicaid systems. 

I welcome all of our witnesses and I hope they can answer the hard questions this 
Committee has for them. In particular, I want to know why the Centers for Medi- 
care and Medicaid Services (CMS), a federal agency that has a budget of almost 
$800 billion a year and a Center dedicated to Program Integrity can not give us an 
estimate on how much money is lost to fraud each year. 

It is frustrating that we all agree fraud is a problem, we all want to solve the 
problem, and yet, we still don’t even know the scope of the problem. Now why is 
that important? I believe that if you don’t know what the problem is, you can’t set 
goals on how to solve it. So let’s say it’s a 10 percent problem which would be $80 
billion. Maybe a reasonable goal then would be to cut that by 25 percent in a given 
year, which would be $20 billion. Maybe it’s only a 40 billion problem a year. But 
if you guys can’t help us determine what the problem is, it is hard for us to decide 
how to set goals to solve it. 

This inability is deeply disappointing considering in less than three years, under 
the Affordable Care Act, this agency will take over much of the healthcare system 
and President Obama has repeatedly stated that one of the ways he plans to fund 
Obamacare is by saving billions of dollars by identifying and preventing this fraud. 

Mr. Chairman, the hearing today highlights just one of the many flaws of expand- 
ing huge entitlement programs that are currently unmanageable, unsustainable, 
and highly susceptible to waste, fraud, and abuse. 
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Mr. Stearns. I thank the gentleman, and I recognize the ranking 
member from Colorado, Ms. DeGette. 

Ms. DeGette. Thank you very much, Mr. Chairman. 

OPENING STATEMENT OF HON. DIANA DEGETTE, A REP- 
RESENTATIVE IN CONGRESS FROM THE STATE OF COLO- 
RADO 

Ms. DeGette. Mr. Chairman, Medicare and Medicaid fraud have 
been persistent problems that have plagued both Democratic and 
Republican Administrations, as you have said, and it costs Ameri- 
cans billions of dollars every year. It affects health care providers 
at every level in the programs themselves and also in the private 
sector. 

Today’s hearing will focus on a very worthy target of oversight: 
waste, fraud and abuse in these two systems. Medicare and Med- 
icaid provide millions of people with access to medical services and 
so it is a vital concern to this committee that we maintain their in- 
tegrity. 

Fortunately, as you said, it is important to try to get a handle 
on Medicare and Medicaid fraud, and that is also a high priority 
for President Obama. Beginning in 2009, the Obama Administra- 
tion made fighting fraud a priority. These efforts expanded even 
more after passage of the Affordable Care Act, which contains doz- 
ens of provisions designed to help fight Medicare and Medicaid 
fraud. 

The Administration asked for and received additional funding to 
fight health care fraud in both 2009 and 2010. They have reorga- 
nized within HHS and they have started several new collaborations 
with law enforcement authorities to uncover and prevent health 
care fraud. 

In May of 2009, HHS and DOJ announced the creation of the 
Health Care Fraud Prevention and Enforcement Team, or HEAT, 
designed to coordinate Cabinet-level agency activities to reduce 
fraud. Under the HEAT program, HHS and DOJ have expanded 
the use of dedicated strike force teams, placing law enforcement 
personnel in locations that are identified as health care fraud 
hotspots. These teams carried out the largest health care fraud 
takedown in U.S. history last month, netting over 100 arrests in 
just one day. The work undertaken by the strike force teams has 
led to criminal charges against 829 defendants for defrauding 
Medicare of almost $2 billion. There is an answer to your question 
about the extent of this. 

The Administration’s efforts have been a huge success for tax- 
payers, with a return on investment that would make most hedge 
fund managers jealous. And thanks to landmark health care reform 
law passed by Congress last year, HHS and law enforcement au- 
thorities now have a host of new tools and new funding to fight 
fraud. 

The Affordable Care Act contains dozens of new provisions to 
fight Medicare and Medicaid fraud. The most important changes 
allow CMS to apply a preventative model in its antifraud efforts. 
For years, CMS employed, as you said, a “pay and chase” model of 
enforcement, simply paying fraudsters’ claims, then attempting to 
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recover its losses. Now, CMS has new authority to keep fraudsters 
out of Medicare and Medicaid in the first place. 

The Affordable Care Act contains stiffer enrollment requirements 
for all providers, mandates enhanced background checks, adds new 
disclosure requirements, and calls for onsite visits to verify pro- 
vider information. It requires that providers create internal compli- 
ance programs, and it contains several provisions aimed directly at 
fighting fraud in, as you mentioned, the high-risk durable medical 
equipment and home health programs. 

The government’s ability to act once it has uncovered fraud or 
the possibility of fraud is also enhanced by the Affordable Care Act. 
The Secretary now has authority to enact moratoria on enrolling 
new providers if she believes that such enrollments will increase 
fraud risks, and she can suspend payments to providers where 
there is a substantiated allegation of fraud. Once fraud has been 
proven, the Affordable Care Act provides stiffer monetary penalties 
and expands the HHS Inspector General’s authority to exclude vio- 
lators from the Medicare and Medicaid programs. 

Data sharing and collection between CMS, States, and other fed- 
eral health programs are modernized under the Affordable Care 
Act, and the Affordable Care Act provides an estimated $500 mil- 
lion in increased funding over the next 5 years to fight fraud, 
money that will return billions of dollars to the taxpayers. This ex- 
panded authority, combined with the coordinated and focused at- 
tention of the Obama Administration, has laid the groundwork for 
a new era in the Federal Government’s response to fraud. 

Mr. Chairman, as you said, the GAO first designated Medicare 
a high-risk program in 1990, and Medicaid joined the high-risk list 
in 2003. I look forward to hearing from the GAO about why this 
is the case and what can be done. I am hoping that these new com- 
mitments that I just talked about can really substantially reduce 
fraud and ultimately produce the result that all of us want. 

Mr. Chairman, if there is more than we can do to reduce waste, 
fraud and abuse on a bipartisan level, I would be eager to hear it 
and I would be happy to work with you and your colleagues on 
both sides of the aisle to make sure that we can do that because 
I think one thing we can agree on in a bipartisan way is, nobody 
wants to see money wasted and we certainly do not want to see 
fraud, waste and abuse in Medicare and Medicaid. 

And with that, I yield back. 

[The prepared statement of Ms. DeGette follows:] 

Prepared Statement of Hon. Diana DeGette 

Health care fraud costs Americans billions of dollars every year. Fraud affects 
health care providers at all levels, in Medicare and Medicaid, and in the private sec- 
tor. 

Today’s hearing will focus on a worthy target of oversight: waste, fraud, and 
abuse in the Medicare and Medicaid programs. Medicare and Medicaid provide mil- 
lions of people with access to essential medical services, and the integrity of these 
programs is a vital concern of this Committee. 

Fortunately, fighting waste, fraud, and abuse in Medicare and Medicaid is also 
a high priority for President Obama. Beginning in 2009, the Obama Administration 
made fighting fraud a priority. These efforts expanded even more after passage of 
the Affordable Care Act, which contained dozens of provisions designed to help fight 
Medicare and Medicaid fraud. 
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The Administration asked for and received additional funding to fight health care 
fraud in 2009 and 2010. They have reorganized within HHS and started several new 
collaborations with law enforcement authorities to uncover and prevent health care 
fraud. 

In May of 2009, HHS and DOJ announced the creation of the Health Care Fraud 
Prevention and Enforcement Team (or “HEAT”), designed to coordinate Cabinet- 
level agency activities to reduce fraud. Under the HEAT program, HHS and DOJ 
have expanded the use of dedicated strike force teams, placing law enforcement per- 
sonnel in locations that are identified as health care fraud hotspots. These teams 
carried out the largest health care fraud takedown in U.S. history last month, net- 
ting over 100 arrests in a single day. The work undertaken by strike force teams 
has led to criminal charges against 829 defendants for defrauding Medicare of al- 
most $2 billion. 

The Administration’s efforts have been a huge success for teixpayers, with a re- 
turn-on-investment that would make most hedge fund managers jealous. And 
thanks to the landmark health care reform law passed by Congress last year, HHS 
and law enforcement authorities now have a host of new tools and new funding to 
fight fraud. 

The Affordable Care Act contains dozens of new provisions to fight Medicare and 
Medicaid fraud. 

The most important changes allow CMS to apply a preventive model in its anti- 
fraud efforts. For years, CMS employed a “pay and chase” model of enforcement, 
simply paying fraudsters’ claims, then attempting to recoup its losses. Now, CMS 
has new authority to keep fraudsters out of Medicare and Medicaid in the first 
place. 

The Affordable Care Act contains stiffer enrollment requirements for all providers, 
mandates enhanced background checks, adds new disclosure requirements, and calls 
for on-site visits to verify provider information. It requires that providers create in- 
ternal compliance pro^ams. And it contains several provisions aimed directly at 
fighting fraud in the high-risk durable medical equipment and home health pro- 
grams. 

The government’s ability to act once it has uncovered fraud or the possibility of 
fraud is also enhanced by the Affordable Care Act. The Secretary now has authority 
to enact moratoria on enrolling new providers if she believes that such enrollments 
will increase fraud risks, and she can suspend payments to providers where there 
is a substantiated allegation of fraud. Once fraud has been proven, the Affordable 
Care Act provides stiffer civil monetary penalties and expands the HHS Inspector 
General’s authority to exclude violators from the Medicare and Medicaid programs. 

Data sharing and collection between CMS, States, and other federal health pro- 
grams are modernized under the Affordable Care Act. 

And the Affordable Care Act provides an estimated $500 million in increased 
funding over the next five years to fight fraud — money that will return billions of 
dollars to the teixpayer. 

This expanded authority, combined with the coordinated and focused attention of 
the Obama Administration, has laid the groundwork for a new era in the federal 
government’s response to health care fraud. 

The Government Accountability Office first designated Medicare a “high-risk” pro- 
gram in 1990, and Medicaid joined the “high-risk” list in 2003. For two decades, the 
programs have been on GAO’s high priority list. We will hear today from GAO about 
why this is the case, and what can be done. I am hopeful that the Obama Adminis- 
tration’s commitment to reducing fraud, and the substantial anti-fraud boost pro- 
vided by the Affordable Care Act will ultimately produce the result that preceding 
Republican and Democratic Administrations have been unable to achieve: removal 
of Medicare and Medicaid from the GAO high-risk list. 

Waste, fraud, and abuse in Medicare and Medicaid are bi-partisan problems, and 
I believe there is bi-partisan commitment to combating them. I hope there is also 
bi-partisan recognition of the commendable anti-fraud efforts undertaken by the 
Obama Administration and the vital anti-fraud authority granted by the Affordable 
Care Act. 5 

I thank the witnesses for joining us here today and look forward to hearing their 
testimony on this important topic. 

Mr. Stearns. The gentleman from Texas, Mr. Burgess, is recog- 
nized for 3 minutes. 

Mr. Burgess. I thank the chairman and I thank our witnesses 
for being here today. I know several of you we have seen before and 
several of you we have seen several times before, which just under- 
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scores the problem that at the federal level we have really not done 
enough to address the issue of fraud, and as the reports that we 
have in front of us indicate that our Nation’s government-run 
health care system needlessly does waste billions of dollars each 
year through programs that are ineffective and unfocused. 

Fraud analysts and law enforcement officials estimate, and we 
have heard the figures already, 10 percent, as Mr. Barton did the 
math for us on an $800 billion public program. That is a substan- 
tial sum of money every year, and over a 10-year budget window, 
it is really astounding. But 10 percent of total health care expendi- 
tures are lost to fraud on an annual basis. 

The point has been raised by others, I have raised it numerous 
times before, how much fraud is enough for us to take notice? The 
answer that we all expect to see in the amount of fraud is none, 
zero, zero tolerance, but in reality, sometimes it is even as simple 
as just the lack of a prosecutorial force with the background in 
prosecuting health care laws cripples our ability to go after the peo- 
ple that need to be gone after, and certainly that has been true in 
my communities in north Texas where repeated violations by some 
of the same people who have multiple provider numbers but a sin- 
gle post office box, you can bust someone in the morning but we 
are sending out payments to the same post office box under a dif- 
ferent provider number that afternoon. Clearly, that has to stop. 

Now, the Government Accountability Office has been able to 
identify areas where they may have made recommendations to the 
Centers for Medicare and Medicaid Services to prevent improper 
payments, some really dating back almost a decade, and they failed 
to fully implement them and that in fact has caused fraud to rise. 
If we are serious about bringing down the cost of health care and 
protecting the patient not just reducing but eliminating fraud, that 
needs to be the goal for which we strive. 

Medicaid expansion under the landmark health care legislation 
passed last year that has already been referenced but Medicaid ex- 
pansion under the Affordable Care Act is estimated to exceed $430 
billion over the next 10 years. Under current standards, taxpayers 
would be losing over $40 billion a year to fraud. 

Now, we also talk about the medical loss ratio and how we are 
going to control costs in the private sector but I would just simply 
ask, what is a more cogent indicator of medical loss ratio than dol- 
lars that are lost to fraud? Maybe we ought to include that in our 
calculation. 

I realize the clock is misbehaving. Let me yield back to the chair- 
man because I think he has others he wants to recognize. 

Mr. Stearns. Thank you, Mr. Burgess. 

Mr. Bilbray of California is recognized for 1 minute and then Mr. 
Gingrey. 

Mr. Bilbray. Thank you, Mr. Chairman. 

Mr. Chairman, I think there are many ways of addressing the 
potential or the existence of the fraud issue. I think that one of the 
concerns that a lot of people had when we were talking about ex- 
panding health care coverage last year was the President stood on 
the podium and said I assure you that those who are illegally in 
this country will not have access to this system, though when the 
bill was passed there was no requirement for verification, the same 
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verification required almost of every other federal program wasn’t 
included in that expansion of health care service. I would like to 
make sure that we all address the fact that if you do not verify, 
if you do not use the check system, you cannot straight face in the 
American people and tell us that people who are not qualified are 
going to be kept out of this system. Just by saying they are not al- 
lowed to participate in the system is as logical as saying that pro- 
viders will not create a fraud because we have said that they 
shouldn’t do it. There has got to be some checks and balances here. 

And just as much as need to make sure that we are on top and 
checking the providers of the services, we also have a responsi- 
bility, especially after the President promised the American people 
that they would not participate is to make sure that we check and 
have a verification system for those who are providing the services 
and those who are being provided to those services, and I think not 
until we are willing to do that across the board with all of our 
health care system can we truly have our President stand up and 
assure the American people with a straight face that no, we are 
doing everything possible to make sure we fighting fraud in this 
country and we make sure that every dollar spent on health care 
in this country is going only to those who qualify and only being 
provided under a legal system. 

I yield back. 

Mr. Stearns. The gentleman yields back. 

The gentleman from Georgia, Mr. Gingrey, is recognized for 1 
minute. 

Mr. Gingrey. Mr. Chairman, thank you. I am very pleased to 
welcome the witnesses on both the first and second panel. I look 
forward to hearing their testimony. 

I practiced medicine for 31 years, 26 of those years in the spe- 
cialty of obstetrics and gynecology, so this issue of waste, fraud and 
abuse, particular in our Medicare and Medicaid systems, is some- 
thing that really, really gets to me, and some of the comments that 
I have heard already this morning, particular from the other side, 
you would almost think that one of the reasons for adopting 
Obamacare or the Affordable Care Act was so that we could suc- 
ceed in combating waste, fraud and abuse. I certainly don’t agree 
with that, and if it is true, then it will be more successful than the 
bill has been in lowering the cost of health care to individuals who 
are now uninsured. It will do more than it has done in regard to 
medical liability reform that was promised. It will do much more 
than providing a sustainable rate of reimbursement to our hard- 
working health care providers that was promised. So it kind of re- 
mains to be seen what is in this bill that is going to make us more 
successful in combating waste, fraud and abuse. 

But in any regard, I look forward to hearing from the witnesses 
and we do need to get a handle on this problem, and I yield back. 

Mr. Stearns. I thank the gentleman, and Mr. Waxman, the 
ranking member of the full committee, is recognized for 5 minutes. 

Mr. Waxman. Thank you very much, Mr. Chairman. 
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OPENING STATEMENT OF HON. H ENRY A. WAXMAN, A REP- 
RESENTATIVE IN CONGRESS FROM THE STATE OF CALI- 
FORNIA 

Mr. Waxman. Well, this hearing is a very useful one already be- 
cause we have the opportunity to educate two of our Republican 
members about the accuracy of the legislation that we just adopted. 
One of the reasons I am so proud of the Affordable Care Act, the 
historic health care reform law signed by President Obama last 
year, is that it contains dozens of antifraud provisions. This legisla- 
tion has the most important reforms to prevent Medicare and Med- 
icaid fraud in a generation. According to the Concessional Budget 
Office, these new fraud provisions will save over $7 billion for tax- 
payers. 

The health care reform law shifts the prevailing fraud prevention 
philosophy from pay and chase where law enforcement authorities 
only identify fraud after it happens to inspect and prevent. It al- 
lows CMS to impose moratoria on enrolling new providers if the 
Secretary believes that such enrollments will increase fraud risk. 
It allows the HHS Secretary to close the barn door before the 
horses have left. 

The new law also contains new penalties for fraudulent providers 
and new data-sharing provisions to catch criminals, and it provides 
hundreds of millions of dollars in new funding to help CMS, the In- 
spector General and the Department of Justice fight Medicare and 
Medicaid fraud, and we will hear today about how the CMS and 
Inspector General have already put these funds to work. I am 
proud of these efforts to reduce fraud. 

The second thing I want to point out is that the legislation does 
not allow undocumented aliens to access Medicare or Medicaid or 
the exchanges, and it is not just on their self-affirmation that they 
are not here illegally, it is based on an inspection that is required 
under the law. That can be done in two ways. They can either 
check with Social Security, get all the information to be sure that 
the claimant is accurately stating his or her status, or they can re- 
quire the birth certificates and passports and other information to 
be produced to show that they are not taking advantage. So these 
oversight hearings have a real opportunity to educate people. 

I can’t tell you how much I think this is an important reason for 
our hearing. When we have health care fraud, it robs the taxpayers 
of funds, affects the quality of care provided to program enrollees 
and saps public confidence in the Medicare and Medicaid programs. 
And that is why I see fighting Medicare and Medicaid fraud as a 
critical need and an issue where we should be able to achieve bi- 
partisan consensus. 

But I am wary of those who use the existence of fraud in these 
programs for the express purpose of undermining support for them. 
I do not believe we should attempt to exaggerate the scope of the 
problem just to foster ideological efforts to cut or eliminate them. 
When I hear estimates of the amount of Medicare and Medicaid 
fraud that have no basis in fact, or when members confuse Medi- 
care and Medicaid improper payment rates that consists mostly of 
simple paperwork or clerical errors with the rate of intentional 
fraud against the programs, then I become concerned that mem- 
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bers are just using fraud as an excuse to bash these programs, not 
to improve them. 

The vast majority of Medicare and Medicaid providers are com- 
passionate and honest. The vast majority of beneficiaries of these 
programs desperately need the care that is provided. We need to 
be tough on fraud and tough on criminals who take advantage of 
these programs and their beneficiaries, but we cannot and should 
not blame the victim. 

In January, every single Republican Member of Congress voted 
to repeal the entire Affordable Care Act, including essential anti- 
fraud provisions. In February, as part of the Continuing Resolu- 
tion, every single Republican voted to ban the use of funds to im- 
plement the Affordable Care Act, including the funds needed to im- 
plement the antifraud provisions. That vote was penny-wise and 
pound-foolish. 

We are going to hear from CMS, from the HHS Inspector Gen- 
eral and from GAO about the new authority and new funding they 
have to eliminate Medicare and Medicaid fraud, thanks to the Af- 
fordable Care Act, and I hope this testimony will make some mem- 
bers reconsider their views. If we truly care about protecting the 
taxpayer, we should support, not defund, the Administration’s ini- 
tiatives to reduce Medicare and Medicaid fraud. 

I yield back the balance of my time. 

[The prepared statement of Mr. Waxman follows:] 

Prepared Statement of Hon. Henry A. Waxman 

Mr. Chairman, I want to thank you for holding this hearing today, and for focus- 
ing on the important topic of Medicare and Medicaid fraud. 

I have dedicated much of my career in Congress to improving the Medicare and 
Medicaid programs and the quality of care they provide and pursing waste, fraud, 
and abuse in government spending. This hearing combines both subjects. 

Health care fraud robs taxpayers of funds, affects the quality of care provided to 
program enrollees, and saps public confidence in the Medicare and Medicaid pro- 
grams. That’s why I see fighting Medicare and Medicaid fraud as a critical need — 
and an issue where we should be able so achieve bipartisan consensus. 

But I am wary of those who use the existence of fraud in these programs for the 
express purpose of undermining support for them. I do not believe we should at- 
tempt to exaggerate the scope of the problem just to foster ideological efforts to cut 
or eliminate them. 

When I hear estimates of the amount of Medicare and Medicaid fraud that have 
no basis in fact . or when members confuse a Medicare and Medicaid “improper pay- 
ments” rate that consists mostly of simple paperwork or clerical errors with the rate 
of intentional fraud against the programs . then I become concerned that members 
are just using fraud as an excuse to bash these programs, not to improve them. 

The vast majority of Medicare and Medicaid providers are compassionate and hon- 
est. The vast majority of beneficiaries of these programs desperately need the care 
they provide. We need to be tough on fraud and tough on criminals who take advan- 
tage of these programs and their beneficiaries — but we can and should not blame 
the victim. 

One of the reasons I am so proud of the Affordable Care Act, the historic health 
care reform law signed into law by President Obama last year, is that it contains 
dozens of anti-fraud provisions. The legislation has the most important reforms to 
prevent Medicare and Medicaid fraud in a generation. According to the Congres- 
sional Budget Office, these new fraud provisions will save over $7 billions for tax- 
payers. 

The health care reform law shifts the prevailing fraud prevention philosophy from 
“pay and chase” — where law enforcement authorities only identify fraud after it 
happens — to “inspect and prevent.” 



12 


It allows CMS to impose moratoria on enrolling new providers if the Secretary 
believes that such enrollments will increase fraud risks. This allows the HHS Sec- 
retary close the barn door before the horses have left. 

The new law also contains new penalties for fraudulent providers and new data 
sharing provisions to catch criminals. 

And it provides hundreds of millions of dollars in new funding to help CMS, the 
Inspector General, and the DOJ fight Medicare and Medicaid fraud. We will hear 
today about how the CMS and the Inspector General have already put these funds 
to work. 

I am proud of these efforts to reduce fraud. 

In January, every single Republican member of Congress voted to repeal the en- 
tire Affordable Care Act, including these essential anti-fraud provisions. In Feb- 
ruary, as part of the Continuing Resolution, every single Republican voted to ban 
the use of funds to implement the Affordable Care Act, including the funds needed 
to implement the anti-fraud provisions. That vote was penny-wise, pound-foolish. 

We will hear today from CMS, from the HHS Inspector General, and from GAO 
about the new authority and new funding they have to eliminate Medicare and Med- 
icaid fraud, thanks to the Affordable Care Act. I hope this testimony will make some 
members reconsider. 

If we truly care about protecting the taxpayer, we should support — not defund — 
the Administration’s initiatives to reduce Medicare and Medicaid fraud. 

Mr. Stearns. I thank the gentleman. 

At this point we will go to our witnesses, and we have our wit- 
nesses at the table. The first is Kathleen King, Director of Health 
Care Division, Government Accountability Office. She is the direc- 
tor of this health care team at the U.S. Government Accountability 
Office, which is responsible for leading various studies of the health 
care system, specializing in Medicare management and prescription 
drug coverage. She has more than 25 years’ experience in health 
policy and administration. She received her M.A. in government 
and politics from the University of Maryland. 

We have John Spiegel, who is Director of Medicare Program In- 
tegrity, Centers for Medicare and Medicaid Services. He has 
worked in various components of the Centers for Medicare and 
Medicaid Services. After several years working outside the public 
sector, he returned to federal service in 2010 as the Director of the 
Medicare Program Integrity Group. 

Then we have Gerald Roy, who is Deputy Inspector General for 
Investigations, Department of Health and Human Services. He has 
served in GIG since 1995. He was also instrumental in increasing 
OIG’s civil and criminal conviction record and a 25 percent increase 
in OIG’s monetary recoveries from $3 billion in 2008 to over $4 bil- 
lion in 2009. 

And then we have Omar Perez, Assistant Special Agent in 
Charge, Health and Human Service Office of the Inspector General, 
Miami Regional Office. He joined the department in July 1998 and 
he has been promoted to special agent in January 1999. He has led 
a number of successful criminal and civil investigations and orches- 
trated Project Ghost Rider to address fraudulent ambulance compa- 
nies, Bad Medicine to address Puerto Rico’s Medicaid equivalent, 
and the First Child Support Round in the U.S. Virgin Islands. 

So I welcome our witnesses, and let me swear you in first of all. 

[Witnesses sworn.] 

Mr. Stearns. Ms. King. 
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STATEMENTS OF KATHLEEN KING, DIRECTOR, HEALTH CARE 
DIVISION, GOVERNMENT ACCOUNTABILITY OFFICE; GER- 
ALD T. ROY, DEPUTY INSPECTOR GENERAL FOR INVESTIGA- 
TIONS, OFFICE OF THE INSPECTOR GENERAL, DEPARTMENT 
OF HEALTH AND HUMAN SERVICES; OMAR PEREZ, ASSIST- 
ANT SPECIAL AGENT IN CHARGE, OFFICE OF INSPECTOR 
GENERAL, DEPARTMENT OF HEALTH AND HUMAN SERV- 
ICES; AND JOHN SPIEGEL, DIRECTOR OF MEDICARE PRO- 
GRAM INTEGRITY, CENTERS FOR MEDICARE AND MEDICAID 
SERVICES, DEPARTMENT OF HEALTH AND HUMAN SERV- 
ICES 


STATEMENT OF KATHLEEN KING 

Ms. King. Mr. Chairman, members of the subcommittee, thank 
you for inviting me today to speak about our recent high-risk re- 
port, specifically about Medicare. We have continued to designate 
Medicare as a high-risk program because of its complexity and sus- 
ceptibility to improper payment added to its size. This has led to 
serious management challenges. 

In 2010, Medicare covered 47 million elderly and disabled bene- 
ficiaries and had estimated outlays of $509 billion, making it the 
third largest federal programs in terms of spending. 

Currently, Medicare remains on a path that is fiscally 
unsustainable in the long term. This heightens the urgency for the 
Centers for Medicare and Medicaid Services to address our rec- 
ommendations, effectively implement new laws and guidance and 
improve its management in four areas. Broadly, these areas in- 
clude reforming and refining payments, improving program man- 
agement, enhancing program integrity and overseeing patient care 
and safety. Today I am going to focus my oral comments on pay- 
ments and program integrity. 

With regard to reforming and refining payments, CMS has im- 
plemented payment reforms such as for Medicare Advantage, inpa- 
tient hospital and home health services. It has also begun to pro- 
vide feedback to physicians on their resource use, which is positive 
but which could benefit from additional refinement, and is devel- 
oping a new payment system that accounts for the cost and quality 
of care. But more could be done. For example, we have rec- 
ommended to CMS that they consider implementing more front-end 
approaches to controlling the growth of imaging services. In addi- 
tion, we recently found that although payments for home oxygen 
have been reduced or limited several times in recent years, further 
savings are possible. 

In regard to program integrity. Congress recently passed laws in- 
cluding the Improper Payments Elimination and Recovery Act, the 
Patient Protection and Affordable Care Act and the Small Business 
Job Act that provide authority and resources and impose new re- 
quirements designed to help CMS reduce improper payments. 

The Administration has also issued executive memoranda includ- 
ing one that requires agencies to check certain databases known as 
the Do Not Pay List before making payments to ensure that pay- 
ments are not made to individuals who are dead or entities that 
have been excluded from federal programs. CMS is taking steps to 
implement these laws and memoranda through regulations and 
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other agency actions. In 2010, it created a new Center for Medicare 
and Medicaid Program Integrity to better coordinate efforts to pre- 
vent improper payments. CMS has been tracking its improper pay- 
ment rates in Medicare fee for service and Medicare Part C and 
has established performance goals for reducing those rates in the 
future. However, the agency has not reported a single error rate for 
Part D and has not been able to demonstrate sustained progress 
in lowering its improper payment rates. So continued oversight is 
warranted. 

Having a corrective action process in place to address 
vulnerabilities that lead to improper payments is also important to 
managing them effectively. Our work on recovery auditing, which 
reimburses contracts on a contingency basis to uncover payments 
that should not have been made found that CMS had not developed 
an adequate process to address the vulnerabilities that had been 
identified by the contractors. Since it is important to address these 
issues going forward, we recommended that CMS develop a robust 
corrective action process. 

Further, we issued a report in February 2009 that indicated that 
Medicare continued to pay some home health agencies for services 
that were not medically necessary or were not rendered. To address 
this, we made several recommendations including that CMS direct 
its contractors to conduct post-payment reviews on home health 
agencies with high rates of improper payments. CMS has not im- 
plemented this and several other recommendations to improve its 
program safeguards. 

In conclusion, although CMS has taken many actions to improve 
the integrity of the Medicare program, further action is needed to 
ensure that payments are proper and vulnerabilities to improper 
payments are addressed. We are beginning new work to address 
some of these issues to determine if additional agency or Congres- 
sional action might be helpful. 

Mr. Chairman, this concludes my statement. I would be happy 
to answer any questions. 

[The prepared statement of Ms. King follows:] 
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What GAO Found 

As GAO reported in its 201 1 High-Risk Series update, Medicare remains on a 
path that is fiscally unsustainable over the long term. This fiscal pressure 
heightens CMS’s challenges to reform and refine Medicare’s payment methods 
to achieve efficiency and savings, and to improve its management, program 
integrity, and oversight of patient care and safety. CMS has made some 
progress in these areas, but many avenues for improvement remain. 

Reforming and refining payments. Since January 2009, CMS has 
implemented payment reforms for Medicare Advantage and inpatient hospital 
and ot.her services, and has taken other steps to improve efficiency in 
payments. The agency has also begun to provide feedback to physicians on 
tiieir resource use, but the feedback effort could be enhanced. CMS has 
taken steps to ensure that some physician fees recognize efficiencies when 
certain services are furnished together, but the agency has not targeted the 
services with the greatest potential for savings. Other areas that could benefit 
from payment method refinements include oxygen and imaging services. 

Improving program management. CMS’s implementation of competitive 
bidding for medical equipment and supplies and its transfer of fee-for-service 
claims workload to new Medicare Administrative Contractors have 
progressed, with some delays. Of greater concern is that GAO found pervasive 
internal control deficiencies in CMS’s management of contracts that increased 
the risk of improper payments. While the agency has taken actions to address 
some GAO recommendations for improving internal controls, it has not 
completely addressed recommendations related to clarifying the roles and 
responsibilities for implementing certain contractor oversight responsibilities, 
clearing a backlog of contacts that are overdue for closeout, and finisliing its 
investigation of over $70 million in payments GAO questioned in 2007, 

Enhancing program integrity. CMS has implemented a national Recovery 
Audit Contractors (RAC) program to analyze paid claims and identify 
improper overpayments for recoupment, set performance measures to reduce 
improper payments, issued regulations to tighten provider enrollment, and 
created its Center for Program Integrity, However, the agency has not 
developed an adequate process to address vulnerabilities to improper 
payments identified by RACs, nor has it addressed three other GAO 
recommendations designed to reduce improper payments, including one to 
conduct poslpayment reviews of claims submitted by home health agencies 
with high rates of improper billing. 

Overseeing patient care and safety, The agency’s oversight of the quality 
of nursing home care has increased significantly in recent years, but 
weaknesses in the survey methodology and guidance for surveillance could 
understate care quality problems. In addition, CMS’s current approach for 
funding state surveys of facilities participating in Medicare is ineffective. 
However, CMS has implemented, or is taking steps to implement, many 
recommendations GAO has made to improve nursing home oversight. 

United States Government Accountability OHice 
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Mr. Chairman and Members of the Subcommittee; 

I am pleased to be here today to discuss GAO's 2011 High-Risk Series 
update on the Medicare program. ‘ My testimony today will focus on 
information in our 201 1 update on the nature of the risk in the Medicare 
program, progress made since our last high-risk update in 2009, and the 
specific actions CMS needs to take to make additional progress, 

We have designated Medicare as a high-risk program because its 
complexity and susceptibility to improper payments, combined with its 
size, have led to serious management challenges. An improper payment is 
any payment that should not have been made or that was made in an 
incorrect amount (including overpayments and underpayments) under 
statutory, contractual, administrative, or other legally applicable 
requirements.^ In 2010, Medicare covered 47 million elderly and disabled 
beneficiaries and had estimated outlays of $509 billion. The Centers for 
Medicare & Medicaid Services (CMS) — the agency in the Department of 
Health and Human Services that administers Medicare — has estimated 
improper payments for Medicare of almost $48 billion for fiscal year 2010. 
However, this improper payment estimate did not include all of the 
program's risk since it did not include improper payments in its Part D 
proscription drug benefit, for which the agency has not yet estimated a 
total amount. ■* 

CMS is responsible for implementing payment methods that encourage 
efficient service delivery, managing the program to serve beneficiaries and 
safeguard it from loss, and overseeing patient safety and care. However, 
CMS faces growing challenges in coming years resolving issues that put 


'GAO, High-Risk Series: An Update, G.AO 1 1-278 (Washington, D.C.: February 201 1). 

definition Includes any payment to an ineligible recipient, any paynient for an 
ineligible good or service, any duplicate payment, any paynient for a good or service not 
received (except where authorized by law), and any payment that does not account for 
credit for applicable discounts. Ihib. L No. 111-204, § 2(e), l24Stat. 2224, 2227 (2010) 
(codified at 31 U.S.C. § 3321 note). 

^Department of Health and Human Services, f-'Yscai Year^OlO Agency Financial Report, 
(Washington, D.C.: November 2010). 

''Medicare consists of four parts. Medicare Parts A and B are known as original Medicare or 
Medicare fee-for-service. Part A covers hospital and other inpatient stays. Medicare Part. B 
covers ho^ital outparient, physician, and other services, i’art C is Medicare Advantage, 
under which beneficiaries receive benefits through private health plcins. Part D is the 
Medicare prescription drug benefit 
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the program at risk, given the rapid growth expected in the number of 
Medicare beneficiaries and program spending. 

Our 201 1 High-Risk Series update on Medicare is based on a body of work 
comprising more than 11 products that were developed by using a variety 
of methodologies, including analyses of Medicare claims, review of 
relevant policies and procedures, interviews with agency officials and 
other stakeholders, and site visits.” It also includes information CMS has 
provided on the status of its actions to address recommendations made in 
these and prior reports on Medicare. Our work was performed in 
accordance with generally accepted government auditing standards. Those 
standards require that we plan and perform the audit to obtain sufficient, 
appropriate evidence to provide a reasonable basis for our findings and 
conclusions based on our audit objectives. We believe that the evidence 
obtained provides a reasonable basis for our findings and conclusions 
based on our audit objectives. 


2011 High-Risk Series 
Update on the 
Medicare Program 


As we report in our 2011 High-Risk Series update, Medicare remains on a 
path that is fiscally unsustainable over the long term. This fiscal pressure 
heightens the need for CMS to reform and refine Medicare’s payment 
methods to achieve efficiency and savings, and to improve its 
management, program integrity, and oversight of patient care and safety, 
CMS has made some progress in these areas, but many avenues for 
improvement remain. 


Reforming and Refining Since January 2009, CMS has implemented payment reforms for Medicare 

Payments Advantage (Part C) and inpatient hospital, home health, and end-stage 

renal disease services. The agency has also begun to provide feedback to 
physicians on their resource use and is developing a value-based payment 
method for physician services that accounts for the quality and cost of 
care. Efforts to provide feedback and encourage efficiency are crucial 
because physician influence on use of other services is estimated to 
account for up to 90 percent of health care spending. 


”For more detailed information on the methodologies used in our work, please consult the 
list of GAO producte at the eiul of this statement. 
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In addition, CMS has taken steps to ensure that some physician fees 
recognize efficiencies when certain services are furnished together, but 
the agency has not targeted the services with the greatest potential for 
savings. Under the budget neutrality requirement, tiie savings that have 
been generated have been redistributed to increase physician fees for 
other services. Therefore, we recommended in 2009 that Congress 
consider exempting savings from a(^usting physician fees to recognize 
efficiencies from budget neutrality to ensure that Medicare realizes these 
savings. 

Our examination of payment rates for home oxygen also found that 
although these rates have been reduced or limited several times, further 
savings are possible. As we reported in January 2011, if Medicare used the 
methodologies and payment rates of the lowest-paying private insurer of 
eight private insurers studied, it could have saved about $670 million of the 
estimated $2.15 billion it spent on home oxygen in 2009. Additionally, we 
found that Medicare bundles its stationary equipment rate payment for 
oxygen refills, but refills are required only for certain types of equipment, 
so a supplier may still receive payment for refills even if the equipment 
does not require them. Therefore, we suggested that Congress should 
consider reducing home oxygen payment rates and recommended that 
CMS remove payment for portable oxygen refills from payment for 
stationary equipment, and thus only pay for refills for the equipment types 
that require them. 

Our work has also shown that payment for imaging services'* may benefit 
from refinements. Specifically, CMS could add more front-end approaches 
to better ensure appropriate payments, such as requiring physicians to 
obtain prior authorization from Medicare before ordering an imaging 
service. CMS also has opportunities to improve the way it adjusts 
physician payments to account for geographical differences in the costs of 
providing care in different localities. We have recommended that the 
agency examine and revise the physician payment localities it uses for this 
purpose by using an approach that is uniformly applied to all states and 
based on the most current data. CMS agreed to consider the 
recommendation but was concerned about its redistributive effects. The 


“Medical imaging is a noninvasive process used to obtain pictures of the internal anatomy 
or function oftlieanatomy using one of many different types of imaging equipment and 
media for creating the image. Examples of imaging services include x-rays, computed 
tomography, and magneUc resonance imaging scans. 
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agency subsequently initiated a study of physician payment locality 
adjustments. The study is ongoing, and CMS has not implemented any 
change. 


Improving Program 
Management 


QMS’s implementation of competitive bidding for medical equipment and 
supplies and its new Medicare Adniinistrative Contractors (MAC) have 
progressed, with some delays. Congress halted the first round of 
competitive bidding and required CMS to improve its implementation. In 
regard to contracting reform, because of delays resulting from bid protests 
filed in connection with the procurement process, CMS did not meet the 
target that it set for 2009 and 2010 in transferring workload to MACs. As of 
December 2010, CMS transferred Medicare fee-for-service claims 
workload to the new MACs in all but six jurisdictions. For those six 
jurisdictions, CMS is transferring claims workload in two jurisdictions and 
has ongoing procurement activity for the remainder. Some new MACs had 
delays in paying providers’ claims, but overall, QMS’s contractors 
continued to meet the agency’s performance targets for timeliness of 
claims processing in 2009. 

Regarding Medicare Advantage, CMS has not complied with statutory 
requirements to mail information on plan disenrollmont to beneficiaries, 
but it did take steps to post this information on its Web site. In addition, 
the agency took enforcement actions for inappropriate marketing against 
at least 73 organizations that sponsored Medicare Advantage plans from 
January 2006 to February 2009. 

Of greater concern is that we found pervasive internal control deficiencies 
in CMS’s management of its contracting function that put billions of 
taxpayer dollars at risk of improper payments or waste. We recommended 
that CMS take actions to address them. Recently, CMS has taken several 
actions to address the recommendations and correct certain deficiencies 
we had noted, such as revising policies and procedures and developing a 
centralized tracking mechanism for employee training. However, CMS has 
not made sufficient progress to complete actions to address 
recommendations related to clarifying the roles and responsibilities for 
implementing certain contractor oversight responsibilities, clearing a 
backlog of contacts that are overdue for closeout, and finishing its 
investigation of over $70 million in payments we questioned in 2007. 
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Enhancing Program New directives, implementing guidance, and legislation designed to help 

Integrity reduce improper payments will affect CMS's efforts over the next few 

years. The administration issued Executive Order 13520 on reducing 
improper payments in 2009 and related implementing guidance in 2010. In 
addition, the Improper Payments Elimination, and Recovery Act of 2010 
amended tlie Improper Payments Information Act of 2002 and established 
additional requirements related to accountability, recovery auditing, 
compliance and noncompliance determinations, and reporting. 

CMS has already taken action in some areas — for example, as required by 
law, it implemented a national Recovery Audit Contractors (RAC) program 
in 2009 to analyze paid claims and identify overpayments for recoupment. 
CMS has set a key performance measure to reduce improper payments for 
Parts A and B (feo-for-service) and Part C and is developing measures of 
improper payments for Part D. CMS was not able to demonstrate sustained 
progress at reducing its fee-for-service error rate because changes made to 
improve the methodology for measurement make current year estimates 
noncomparablo to any issued before 2009. Its 2010 fee-for-service paynient 
error rate of 10.5 percent will serve as the baseline for setting targets for 
future reduction efforts, However, with a 2010 Part C improper payment 
rate of M.l percent, the agency met its target to have its 2010 improper 
payment rate lower than 14.3 percent. For Part D, the agency is working to 
develop a composite improper payment rate, and for 2010 has four non- 
addable estimates, with the largest being $5,4 billion. Other recent CMS 
program integrity efforts include issuing regulations tightening provider 
enrollment requirements and creating its Center for Program Integrity, 
which is responsible for addressing program vulnerabilities leading to 
improper payments. 

However, having corrective action processes to address the vulnerabilities 
that lead to improper payments is also important to effectively managing 
them. CMS did not develop an adequate process to address the 
vulnerabilities to improper payments identified by the RACs and we 
recommended that it do so. Further, our February 2009 report indicated 
that Medicare continued to pay some home health agencies for services 
that were not medically necessary or were not rendered. To help address 
the issue, we recommended that postpayment reviews be conducted on 
claims submitted by home health agencies with high rates of improper 
billing identified through prepayment review and that CMS require that 
physicians receive a statement of home health services that beneficiaries 
received based on the physicians' certification. In addition, we 
recommended that CMS require its contractors to develop thresholds for 
unexplained increases in billing by pro\aders and use them to develop 
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automated prepayment controls as a way to reduce improper payments. 
CMS has not implemented these four recommendations. The agency 
indicated it had taken other actions; however, we believe these actions 
will not have the same effect 

CMS’s oversight of Part D plan sponsors' programs to deter fraud and 
abuse been limited. However, CMS has taken some actions to increase 
it. For example, CMS officials indicated that they had conducted expanded 
desk audits and were implementing an oversight strategy. 


Overseeing Patient Care CMS’s oversight of the quality of nursing home care has increased 
and Safety significantly in recent years, but weaknesses in surveillance remain that 

could understate care quality problems. Under contract with CMS, states 
conduct surveys at nursing homes to help ensure compliance with federal 
quality standards, but a substantial percentage of state nursing home 
surveyors and state agency directors identified weaknesses in CMS's 
survey methodology and guidance. In addition to these methodology and 
guidance weaknesses, workforce shortages and insufficient training, 
inconsistencies in the focus and frequency of the supervisory review of 
deficiencies, and external pressure from the nursing home industry may 
lead to understatement of serious care problems. CMS established the 
Special Facility Focus (SFF) Program in 1998 to help address poor nursing 
home performance. The SFF Program is limited to 136 homes because of 
resource constraints, but according to our estimate, almost 4 percent (580) 
of the roughly 16,000 nursing homes in the United States could be 
considered the most poorly performing. CMS’s current approach for 
funding state surveys of facilities participating in Medicare is ineffective, 
yet these surveys are meant to ensure that these facilities provide safe, 
high-quality care. We found serious weaknesses in CMS’s ability to 
(1) equitably allocate more than $250 million in federal Medicare funding 
to states according to their workloads, (2) determine the extent to which 
funding or other factors affected states’ ability to accomplish their 
workloads, and (3) guarantee appropriate state contributions. These 
weaknesses make assessing the adequacy of funding difficult. 

However, CMS has implemented many recommendations that we have 
made to improve oversight of nursing home care. Of the 96 
recommendations made by GAO from July 1998 through March 2010, CMS 
has fully implemented 45, partially implemented 4, is taking steps to 
implement 29, and did not implement 18. Examples of key 
recommendations implemented by CMS include (1) a new survey 
methodology to improve the quality and consistency of state nursing home 
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surveys and (2) new complaint and enforcement databases to better 
monitor state survey activities and hold nursing homes accountable for 
poor care. 


What Remains to Be Done When legislative and administrative actions result in significant progress 
toward resolving a high-risk problem, we remove the high-risk designation 
from the program. ITie five criteria for determining whether the high-risk 
designation can be removed are (1) a demonstrated strong commitment to, 
and top leadership support for, addressing problems; (2) the capacity to 
address problems; (3) a corrective action plan; (4) a program to monitor 
corrective measures; and (5) demonstrated progress in implementing 
corrective measures. 

CMS has not mot our criteria for removing Medicare from the High-Risk 
List — for example, the agency is still developing its Part D improper 
paynient estimate and has not yet been able to demonstrate sustained 
progress in lowering its fee-for-service and Part C improper payment 
estimates. CMS needs a plan with clear measures and benchmarks for 
reducing Medicare's risk for improper paynients, inefficient payment 
methods, and issues in progratn management and patient care and safety. 

One important step relates to our recommendation to develop an adequate 
corrective action process to address vulnerabilities to improper payments, 
Without a corrective action process that uses information on 
vulnerabilities identified by the agency, its contractors, and others, CMS 
will not be able to effectively address its challenges related to improper 
paynrents. CMS has implentented certain recommendations of oui's, such 
as in the area of nursing home oversight. However, further action is 
needed on our recommendations to improve management of key activities. 
To refine payment methods to encourage efficient provision of services, 
CMS should take action to 

• ensure Uie implementation of an effective physician profiling system; 

• better manage payments for services, such as imaging; 

• systematically apply payment changes to reflect efficiencies achieved by 
providers when services are commonly furnished together; and 

• refine the geographic ac^ustment of physician payments by revising the 
physician payment localities using an approach uniformly applied to all 
states and based on current data. 
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In addition, further action is needed by CMS to establish policies to 
improve contract oversight, better target review of claims for services with 
high rates of improper billing, and improve the monitoring of nursing 
homes with serious care problems. 


Mr. Chairman, this concludes my prepared statement. I would be happy to 
answer any questions you or other members of the subcommittee may 
have. 
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Mr. Stearns. Thank you. 
Mr. Roy. 


STATEMENT OF GERALD ROY 

Mr. Roy. Good morning, Chairman Stearns, Ranking Member 
DeGette and distinguished members of the subcommittee. I am 
Gerald Roy, Deputy Inspector General for Investigations at the 
U.S. Department of Health and Human Services, Office of Inspec- 
tor General. Today I am privileged to have with me GIG Assistant 
Special Agent in Charge Omar Perez of our Miami Regional Office. 

OIG is an independent nonpartisan agency committed to pro- 
tecting the integrity of more than 300 programs administered by 
HHS. The Office of Investigations employs over 450 highly skilled 
special agents who utilize state-of-the-art investigative technologies 
and a wide range of law enforcement actions including the execu- 
tion of search and arrest warrants. We are the Nation’s premier 
health care fraud law enforcement agency. Our constituents are the 
American people, and we work hard to ensure their money is not 
stolen or misspent. Over the past fiscal year, OIG investigations 
have resulted in over 900 criminal convictions and civil actions and 
over $3.7 billion in recoveries. 

Today I will discuss three critical aspects of OIG’s work: the 
Medicare fraud strike force model, corporate fraud investigations 
and tools employed by OIG. The Medicare fraud strike force model 
is a critical component of one of the Administration’s signature ini- 
tiatives known as HEAT. This is a joint effort by HHS and DOJ 
to leverage resources and expertise to prevent fraud and abuse. 
Strike forces concentrate antifraud efforts in geographic areas at 
high risk for fraud. Strike force teams consisting of OIG agents and 
our law enforcement partners are assigned to dedicated prosecu- 
tors. Strike force cases are data driven, which allows us to catch 
criminals in the act. We operate in nine locations and we plan to 
expand to other high-fraud areas. Last month, HEAT strike forces 
engaged in the largest federal health care fraud takedown in our 
history, arresting over 100 defendants in nine cities associated with 
more than $225 million in fraud. More than 300 OIG special agents 
led this operation. The photos you see here today show our special 
agents engaged in search and arrest activities. 

We are also aggressively pursuing major corporations and insti- 
tutions that commit health care fraud on a grand scale. Corporate 
fraud often involves complex kickbacks, accounting and illegal mar- 
keting schemes. Some of these companies play such a critical role 
in the health care delivery system that they may believe that the 
OIG would never exclude them. Some executives consider civil pen- 
alties and criminal fines just the cost of doing business. As long as 
the profit from fraud outweighs the cost, abusive corporate behav- 
ior will continue. OIG plans to alter this cost-benefit calculus of ex- 
ecutives by more broadly employing one of the most powerful tools 
in our arsenal: the authority to exclude individuals and entities 
from participating in federal health care programs. When there is 
evidence that an executive knew or should have known of the un- 
derlying criminal misconduct of the organization, OIG plans to ex- 
clude that executive from our programs. 
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Recently, we assigned a special agent to the International Crimi- 
nal Police Organization, INTERPOL. INTERPOL facilitates inter- 
national investigative cooperation between 188 member countries 
and more than 18,000 law enforcement agencies in the United 
States. HHS OIG is the first in the Inspector General community 
to have a special agent assigned to INTERPOL. We have over 170 
fugitives running from health care fraud charges. We will leverage 
the resources of INTERPOL’s worldwide partners to bring them to 
justice. 

In Eebruary, OIG launched our most-wanted fugitive Web site. 
The individuals you see on our top 10 fugitive poster allegedly de- 
frauded taxpayers of more than $136 million. We have partnered 
with America’s Most Wanted and INTERPOL to feature our Web 
site and actively spread the word. We are asking the public to help 
us bring these fugitives to justice. 

The bottom line: We are sending a clear message that fraud will 
not be tolerated and our success represents a prudent investment 
of taxpayer dollars. Eor every $1 spent on our health care fraud 
programs, we return over $6 to the Medicare trust fund. 

Thank you for the opportunity to discuss our law enforcement ef- 
forts and strategies. We are committed to serving and protecting 
the Nation’s most vulnerable citizens and the federal health care 
programs on which they rely. 

[The prepared statement of Mr. Roy follows:] 
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Testimony of: 
Gerald T. Roy 

Deputy Inspector General for Investigations 
Office of Inspector General, U.S. Department of Health & Human Services 


OIG’S LAW ENFORCEMENT ACTIVITIES TO COMBAT 
MEDICARE AND MEDICAID FRAUD 

Good morning Chairman Steams, Ranking Member DeGette, and distinguished Members of the 
Subcommittee. 1 am Gerald Roy, Deputy Inspector General for Investigations at the U.S. 
Department of Health & Human Services’ (HHS) Office of Inspector General (OIG). Today, I 
am privileged to have with me OIG Assistant Special Agent in Charge Omar Perez who has 
served in the Miami Regional Office since 2007. We thank you for the opportunity to discuss 
OlG’s health care anti-fraud strategy, focusing primarily on our law enforcement activities to 
combat Medicare and Medicaid fraud. 

OIG’s Role and Partners in Protecting the Integrity of Medicare and Medicaid 

OIG is an independent, nonpartisan agency committed to protecting the integrity of the more 
than 300 programs administered by HHS. Approximately 80 percent of OIG’s resources are 
dedicated to promoting the efficiency and effectiveness of federally funded health care programs 
and protecting these programs and our beneficiaries from fraud, waste, and abuse. 

OIG employs more than 1,700 dedicated professionals, including a cadre of over 450 highly 
skilled criminal investigators trained to conduct criminal, civil, and administrative investigations 
of fraud, waste, and abuse related to HHS programs and operations. Our special agents have full 
law enforcement authority to effectuate the broad range of available law enforcement actions, 
including the execution of search and arrest warrants. We utilize state-of-the-art technologies 
and a wide range of law enforcement tools in carrying out these important responsibilities. We 
are the Nation’s premiere health care fraud law enforcement agency. 

Our constituents are the American tax payers and we work hard to ensure that their money is not 
stolen or misspent. Thanks to the work of our dedicated professionals, over the past fiscal year 
OIG opened over 1 ,700 health care investigations and obtained over 900 criminal convictions 
and civil actions. OIG investigations also have resulted in oyer $3.7 billion in expected criminal 
and civil recoveries. 

Range of Investigations 

Fraud, waste, and abuse in the Medicare and Medicaid programs cost taxpayers billions of 
dollars each year and put beneficiaries’ health and welfare at risk. The impact of these losses 
and risks is exacerbated by the growing number of people served by these programs and the 
increased strain on Federal and State budgets. Health care fraud schemes commonly include 
purposely billing for services that were not provided or were not medically necessary, billing for 
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a higher level of service than what was provided, misreporting costs or other data to increase 
payments, paying kickbacks, illegally marketing products, and stealing providers’ or 
beneficiaries’ identities. From street gang members to corporate officers, our investigations are 
uncovering a wide range of individuals and entities committing health care fraud. Below are 
examples of fiaud schemes we that have encountered. 

In southern California, an individual set out to defraud the Medicare program by establishing 
multiple fraudulent durable medical equipment (DME) companies. The owner used members of 
a street gang as nominee owners of his DME companies. He paid the gang members 
approximately $5,000 each to establish baivk accounts and fill out Medicare enrollment 
paperwork. The nominee owners submitted claims for reimbursement to Medicare for power 
wheelchairs and orthotic devices that were not medically necessary or legitimately prescribed by 
a physician. Nine of the gang members and associates were indicted for charges including health 
care fraud and providing false statements to Government agents. Of the nine defendants, eight 
have pled guilty and are currently serving or have completed serving jail time for their crimes. 
Not only is this investigation an example of one of the more prevalent fraud schemes that OIG is 
seeing, but it also highlights the increasing number of violent criminals entering the health care 
fraud arena. The criminal records for the gang members involved in this fraud ranged from 
assault on a peace officer to drug trafficking. 

Another recent case involving violent criminals and organized criminal networks involved 73 
defendants charged with various health care fraud-related crimes with more than $163 million in 
fraudulent billings. According to the indictments, the Armenian-American organized crime ring 
behind the scheme was the Mirzoyan-Terdjanian Organization, which has allegedly used 
violence and threats of violence to ensure payments to its leadership. 

In this crime scheme, criminals allegedly stole the identities of thousands of Medicare 
beneficiaries from around the country, as well as the identities of doctors who were usually 
licensed to practice in more than one State. Other members of the syndicate allegedly leased 
office space, set up fraudulent clinics and opened bank accounts to receive Medicare funds — 
often in the name of the doctor whose identity they had stolen. Upon becoming approved 
Medicare providers, the crooks allegedly billed Medicare for services never provided, using the 
stolen beneficiary information. The funds received from Medicare were quickly withdrawn and 
laundered; sometimes sent overseas. Although Medicare identified and shut down several of the 
phony clinics, members of the criminal enterprise simply opened up more firaudulent clinics, 
usually in another State. The investigation uncovered at least 1 1 8 sham clinics in 25 States. 

Our agents also work on investigations involving fraud committed by large corporate entities. 

For instance, OIG investigated the “Small Smiles” case, a horrific example of egregious health 
care fraud. FORBA Holdings, LLC (FORBA), a management company operating Medicaid 
pediatric dental clinics, recently agreed to pay $24 million plus interest and entered into a 5-year 
quality-of-care Corporate Integrity Agreement (CIA) to settle allegations that it performed 
unnecessary and often painful services on children to maximize Medicaid reimbursement. 
FORBA managed a chain of 68 pediatric dental clinics in 22 States and the District of Columbia 
commonly known as “Small Smiles Centers.” The investigation revealed that among other 
things, FORBA allegedly caused the submission of claims for reimbursement for dental services 
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that either were not medically necessary or did not meet professionally recognized standards of 
care. Such services billed to the Medicaid programs included performing pulpotomies (baby root 
canals), placing multiple crowns, administering anesthesia, performing extractions, and 
providing fillings and sealants. This investigation involved OIG, the Federal Bureau of 
Investigation (FBI), and the National Association of Medicaid Fraud Control Units. 

In 2009, OIG, along with our law enforcement partners, successfully completed one of the 
largest Federal Government settlements in history. Pfizer Inc., a drug manufacturer, and its 
subsidiary, Pharmacia & Upjohn Company, Inc., entered a $2.3 billion global resolution with the 
Federal Government and participating States. The agreement settled charges that Pfizer 
promoted four drugs, including its pain drug Bextra, for uses not approved by Food and Drug 
Administration and that the company paid kickbacks to health care professionals to induce them 
to prescribe Pfizer drugs. In its plea agreement, Pfizer’s subsidiary admitted that it promoted 
Bextra for rmapproved uses and at unapproved dosage levels. Pfizer also entered into a 
comprehensive 5-year CIA with OIG, which requires procedures and reviews to be put in place 
to avoid and promptly detect fi^ud or misconduct. Two corporate managers were charged 
criminally for their role in this matter. 

OIG is not alone in the fight to combat fraud and protect the integrity of Federal health care 
programs. We work closely with the Department of Justice (DOJ); our Federal, State, and local 
law enforcement partners; and our colleagues at the Centers for Medicare & Medicaid Services 
(CMS). Additionally, commercial and private insurance entities and trade associations, such as 
the National Health Care Anti-Fraud Association are also involved in the identification and 
prevention of health care fraud. OIG conducts joint investigations with law enforcement agencies 
where there is concurrent jurisdiction and where sharing expertise or authority will lead to the 
best results possible. 

OIG’s partnerships extend to one of the Administration’s signature initiatives, the Health Care 
Fraud Prevention and Enforcement Action Team (HEAT). HEAT is a joint effort by HHS and 
DOJ to leverage resources, expertise, and authorities to prevent fraud, waste, and abuse in 
Medicare and Medicaid. The HEAT initiative, established by Secretary Kathleen Sebelius and 
Attorney General Eric Holder in May 2009, is an unprecedented partnership that brings together 
senior officials from both Departments with the stated goals of sharing information, spotting 
fraud trends, coordinating prevention and enforcement strategies, and developing new fraud 
prevention tools. OIG contributes its expertise to HEAT by analyzing data for patterns of fraud; 
conducting investigations; supporting Federal prosecutions of providers who commit criminal 
and civil fraud; and pursuing administrative remedies, such as excluding providers from billing 
Federal health care programs. OIG also makes recommendations to HHS to remedy program 
vulnerabilities and prevent fraud and abuse. 
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A critical component of HEAT is the Medicare Fraud Strike Force. Strike Forces are 
collaborative efforts, combining OlG’s law enforcement skills and resources with those of our 
partners in the FBI, Medicaid Fraud Control Units, and other State and local law enforcement 
agencies. The Medicare Fraud Strike Force concentrates its antiifaud efforts in geographic areas 
at high risk for Medicare fraud and has changed the way health care fraud cases are investigated 
and prosecuted. Strike Force cases focus on the development and.implementation of a 
technologically sophisticated and collaborative approach to combat fraud. 

The typical Strike Force case differs from traditional health care fraud investigations. 

Traditional health care fraud investigations are often initiated months after the fraud has been 
perpetrated and rely heavily on information from individuals and dated evidence gathered by 
contract program integrity entities. It is often difficult to identify the perpetrator, who has 
dropped the “business” under investigation, and is on to the next. 

In contrast. Strike Force cases are data driven to pinpoint fraud “hot spots” through the 
identification of unexplainable billing patterns — as they occur. Further, in traditional health care 
cases, the subjects of the investigations often provide some level of legitimate services. The 
majority of subjects in Strike Force cases are engaging in 100 percent fraud, i.e., not providing 
any legitimate services to beneficiaries. These differences allow Strike Force cases to be 
completed more quickly. Strike Force coordination has accelerated the Government’s response 
to criminal fraud, decreasing by roughly half the average time from an investigation’s start to the 
case’s prosecution. 

OIG and DOJ first launched their Strike Force efforts in 2007 in South Florida to identify, 
investigate, and prosecute DME suppliers and infusion clinics suspected of Medicare fraud. 
Building on the success in South Florida, the Strike Force model was expanded to eight 
additional locations — Los Angeles, Houston, Detroit, Brooklyn, Tampa, Baton Rouge, and roost 
recently, Chicago and Dallas. 

Just last month, HEAT Strike Forces engaged in the largest Federal health care fraud takedown 
in history. Teams across the country charged over 100 defendants in 9 cities, including doctors, 
nurses, health care company owners, and executives for their alleged participation in Medicare 
fraud schemes involving more than $223 million in false billing. More than 300 OIG special 
agents participated in partnership with other Federal and State agencies. The defendants charged 
as a part of the operation are accused of various health care-related crimes ranging from violating 
the anti-kickback statute to money laundering to aggravated identity theft. 

As of February 28, 2011, OlG’s Strike Force efforts nationwide have charged over 800 
defendants, of which 390 have been conSncted and sentenced, resulting in over $376 million in 
court-ordered restitutions, fines, and penalties. 
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Corporate Fraud 

Health care fraud is not limited to blatant fraud by career criminals and sham providers. Major 
corporations and institutions, such as pharmaceutical and device manufacturers, hospitals and 
nursing facilities also commit fraud, often on a grand scale. These corporate and institutional 
frauds often involve complex kickbacks, accounting schemes, illegal marketing, and physician 
self-referral schemes. These cases necessitate different, and often more laborious, investigative 
techniques to unravel the complex fraud schemes and build strong cases. 

Investigations of large corporations are often initiated after a “whistleblower” files a law suit on 
behalf of the Government, known as a “qui tam,” alleging wrongdoing by the company. The 
allegations include information that the company engaged in illegal activities that violated the 
False Claims Act. In doing so, the companies cause false claims to be submitted to Federal 
health care programs for payment. The investigations involve coordination among many Federal 
Government departments and agencies whose programs are alleged to have been harmed. 

Investigative techniques utilized in these multi-year, complex corporate investigations include 
reviewing voluminous paper and electronic documents obtained via subpoenas, interviewing 
witnesses, and analyzing diagnosis and claims data. We now use cutting-edge electronic 
discovery tools to maximize investigative efficiency in the processing and review of voluminous 
electronic evidence. Notably, our office was the first Federal law enforcement agency to 
implement such technology. This technology enables OIG to analyze large quantities of email or 
other electronic documents quickly, and to associate or link emails contained in multiple 
accounts based on content and data. 

OIG often negotiates compliance obligations, known as CIAs, such as those discussed earlier in 
the FORBA and Pfizer investigations, with health care providers and other corporate entities as 
part of the settlement of Federal health care program investigations arising under a variety of 
civil false claims statutes. The typical term of a comprehensive CIA is 5 years. This compliance 
measure seeks to ensure the integrity of corporate activities and the Federal health care program 
claims submitted by providers. While many CIAs have common elements, each agreement 
addresses, in part, the specific facts of the conduct at issue. 

I will now address OIG’s strategy to counter through our exclusion authority the fraud schemes 
discussed above and discuss additional high impact tools we employ in our fight against health 
cate fraud. 

Employing Effective Fraud-Fighting Tools 

The effectiveness of our fraud-fighting efforts is enhanced by our use of several tools. We 
continuously implement and evaluate these new tools to ensure we are maximizing our impact on 
health care fraud. 
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Exclusion 

Once we determine that an individual or entity is engaged in fraud, waste, abuse, or the provision 
of substandard care, OIG can use one of the most powerful tools in our arsenal: exclusion from 
participating in Federal health care programs. Program exclusions bolster our fraud fighting 
efforts by removing from the Federal health care programs those who pose the greatest risk to 
programs and beneficiaries. 

There are many grounds for exclusion. Some are mandatory and imposed for a minimum of 5 
years. These include a conviction related to the Medicare or Medicaid program and a conviction 
related to patient abuse. Other exclusions are imposed at OIG’s discretion. There are a 
significant number of such exclusions, including actions based on a sanction taken by a State 
licensing authority or conduct that could trigger False Claims Act liability. 

No program payment may be made for any item or service that an excluded person or entity 
furnishes, orders, or prescribes. This payment prohibition applies regardless of whether the 
excluded person is paid directly by the programs (like a physician) or whether the payment is 
made from the program to another person (such as payments to a hospital for services by its 
employed nurses and other staff, or payments to a pharmacy for dmgs manufactured by a 
pharmaceutical company). Those who employ the services of an excluded individual or entity 
for the provision of items or services reimbursable by Medicare or Medicaid may be subject to 
monetary penalties and program exclusion. Because of its scope and effect, the risk of exclusion 
creates a strong incentive to comply with the programs’ rules and requirements. 

In imposing discretionary exclusions, OIG must weigh the fraud and abuse risks to the programs 
and beneficiaries against the impact on patient access to care if the provider or entity is excluded 
from the Federal health care programs. Some hospital systems, pharmaceutical manufacturers, 
and other providers play such a critical role in the care delivery system that they may believe that 
they are “too big to fire” and thus OIG would never exclude them and thereby risk compromising 
the welfare of our beneficiaries. We are concerned that the providers that engage in health care 
fraud may consider civil penalties and criminal fines a cost of doing business. As long as the 
profit from fraud outweighs those costs, abusive corporate behavior is likely to continue. For 
example, some major pharmaceutical corporations have been convicted of crimes and paid 
hundreds of millions of dollars in False Claims Act settlements and yet continue to participate in 
the Federal health care programs. 

One way to address this problem is to attempt to alter the cost-benefit calculus of the corporate 
executives who run these companies. By excluding the individuals who are responsible for the 
fraud, either directly or because of their positions of responsibility in the company that engaged 
in fraud, we can influence corporate behavior without putting patient access to care at risk. For 
example, in 20G8, we excluded three former executive officers of the pharmaceutical company 
Purdue Frederick based on their convictions for misbranding of the painkiller OxyContin. Each 
of the executives was convicted based on his status as a responsible corporate officer. 
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OIG also has the discretionary authority to exclude certain owners, officers, and managing 
employees of a sanctioned entity (i.e., an entity that has been convicted of certain offenses or 
excluded from participation in the Federal health care programs) even if the executive has not 
been convicted of a crime. This authority, section 1 1 28(b)(l 5) of the Social Security Act, allows 
OIG to hold responsible individuals aceountable for corporate misconduct. OIG has used this 
exclusion authority in over 30 cases since it was added to the statute in 1996. But imtil recently, 
we had typically applied this exclusion authority to individuals who controlled smaller 
companies, such as pharmacies, billing services, and DME companies and not to executives of 
large complex organizations like a drug or device manufacturer. 

We intend to use this essential fiaud-figihting tool in a broader range of eircumstanees. For 
example, in addition to the Purdue Frederick executives, we recently excluded an owner (and 
former exeeutive) of Ethex Corporation under our section (b)(15) exclusion authority. Ethex 
operated manufaeturing facilities in St. Louis. In March of last year, Ethex pled guilty to felony 
criminal charges after it failed to inform the FDA about manufacturing problems that led to the 
produetion of oversized tablets of two prescription drugs. The owner was excluded for a period 
of 20 years. 

We are mindful of our obligation to exercise this authority judiciously, and we do not propose to 
exclude all officers and managing employees of a company that is convicted of a health eare- 
related offense. However, when there is evidence that an executive knew or should have known 
of the underlying criminal misconduct of the organization, OIG will operate with a presumption 
in fiivor of exelusion of that executive. We have published guidance on our Web site that sets 
out factors we will consider when evaluating whether a section (b)(lS) exclusion should be 
imposed in a particular case.’ This guidance alerts health care providers and executives to the 
standards of ethical conduct and responsibility to which they will be held accountable by OIG. 
Even if we decide exclusion of a major health care entity is not in the best interests of Federal 
health care programs and their beneficiaries, we may decide that executives in positions of 
responsibility at the time of the fraud should no longer hold such positions with entities that do 
business with the programs. 

Payment Suspension 

We work closely with CMS to suspend payments to the perpetrators of these schemes and in 
other cases where we have credible evidence of &aud. For example, during a July 2010 Strike 
Foree operation, OIG worked with CMS to initiate payment suspensions and pre-pay edits on 18 
providers and suppliers targeted by the investigation. The prompt action taken by OIG and CMS 
stopped the potential loss of over $ 1 .3 million in claims submitted by the defendants. During the 
February Strike Force operations discussed above, OIG and CMS worked to impose payment 
suspensions that irrunediately prevented a loss of over a quarter million dollars in elaims 
submitted by Strike Force targets. 
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Data Access 

Better access to, and use of, CMS claims data is critical to the Strike Force model and for all 
health care fraud detection and enforcement activities. To be most effective, it is essential that 
law enforcement have access to robust, “real time” claims data - data that are available as soon 
as claims are submitted to Medicare. Timely data is also essential to our ability to respond with 
agility as criminals shift their schemes and locations to avoid detection. We have made important 
strides in obtaining data more quickly and efficiently. We have obtained limited law 
enforcement access to real-time data, and OIG and DOJ are working with CMS to expand this 
access. 

The Strike Force approach also uses data analysis and a collaborative approach to focus 
enforcement resources in geographic areas at high risk for fraud. Strike Force cases are data 
driven to pinpoint fraud hot spots through the identification of suspicious billing patterns as they 
occur. To support this approach, OIG established a team of data experts comprised of OIG 
special agents, statisticians, programmers, and auditors. Together, the team brings a wealth of 
experience in utilizing sophisticated data analysis tools combined with criminal intelligence 
gathered directly from special agents in the field to identify more quickly ongoing health care 
fraud schemes and trends. To expand the coalition of data experts focused on this effort, OIG 
has garnered the support and participation of our law enforcement partners at DOJ and FBI. 

Mutual Assistance 

OIG recently worked with the Council of the Inspectors General on Integrity and Efficiency and 
the U.S. Department of Justice to establish assistance agreements within the Inspector General 
community to leverage law enforcement resources, maximize efficiency, and reduce operational 
costs. As a result, special agents in the IG community can assist each other on law enforcement 
operations, limited in time and scope. Before, when a local OIG office lacked the resources to 
serve multiple search and arrest warrants, special agents traveled from other locations at 
considerable cost to assist. Now, OIG special agents from various OIG offices can assist each 
other. This mutual assistance agreement was used with great success during last month’s major 
Strike Force operation. Special agents from seven OIG offices assisted us in our historic 
takedown. In Miami, for example, those agents knew the geographic areas and were familiar 
with the local communities and customs. Most of those who assisted us spoke Spanish, they 
language spoken almost exclusively in many South Florida communities. Knowledge of local 
environment, ability to speak a common language, and familiarity of local customs results in a 
safer environment in which OIG special agents can operate and conduct law enforcement 
activities. As a result of leveraging the resources of the IG community, we saved in excess of 
$40,000. These funds will be put towards future operations and investigations. 

Interpol 

Recently, we assigned a special agent to INTERPOL Washington, the U.S. National Central 
Bureau (USNCB). USNCB is the official U.S. representative to the International Criminal 
Police Organization (INTERPOL) as designated by the U.S. Attorney General. The USNCB 
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serves as the national point of contact for INTERPOL matters and coordinates international 
investigative cooperation between INTERPOL’S 188 member countries and the more than 
18,000 Federal, State, local and tribal law enforcement agencies in the United States. HHS OIG 
is the first in the Inspector General conununity to have a special agent detailed to INTERPOL. 
We have over 200 fugitives from our investigative efforts, more than 1 70 of which are the result 
of health care fraud investigations. We will leverage the resources and relationships of 
INTERPOL’S, 1 8,000 law enforcement partners worldwide to bring perpetrators of health care 
fraud to justice. 

OIG's Fugitive Website 

Recently, OIG established a fugitive Web site to assist in locating fugitives running from health 
care fraud charges. We have posted on our website the list of the most-wanted health care fraud 
fugitives, including photographs and details on the fugitives and their fraud schemes.^ Our 
current most-wanted list includes 10 individuals who have allegedly defrauded taxpayers of 
approximately $136 million. We have partnered with “America’s Most Wanted” and 
INTERPOL to feature our Web site and actively engaged the media to spread the word that we 
are searching for these fugitives. We are asking the public to help us bring these fugitives to 
justice by reporting any information about their whereabouts to our Web site or fugitive hotline 
(1-888-476-4453). 

Conclusion 

OIG’s efforts that I have discussed today are critical aspects of a multi-agency effort to protect 
the vitality, integrity and finite resources of the Federal health care programs. We are committed 
to investing in program integrity efforts in order to send a clear message that fraud in our Federal 
health care programs will not be tolerated. 

By attacking fraud vigorously, wherever it exists, we all stand to benefit. Medicare Trust Fund 
resources will be protected and remain available for their intended purposes. Medicare dollars 
that have gone to fraudulent providers will instead be available to serve the critical health care 
needs of our program beneficiaries. And most importantly, we can ensure that our seniors and 
persons with disabilities receive the necessary services and care they need to stay healthy, so as 
to enjoy enhanced well-being and quality of life. 

Finally, our anti-fraud efforts represent a prudent investment of taxpayer dollars. Over the past 3 
years, for every $ 1 spent on the health care fraud and abuse control program, an average of $6.80 
has been returned to the Government. 

Thank you for the opportunity to discuss our law enforcement efforts and strategies used to 
protect the integrity of Federal health care programs. 


^ Available at hltp://oig.hhs.gov/fugiiives/. 
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Mr. Stearns. Thank you. 

Mr. Perez, welcome. 

STATEMENT OF OMAR PEREZ 

Mr. Perez. Good morning, Chairman Stearns, Ranking Member 
DeGette and distinguished members of the subcommittee. I am 
Omar Perez, Assistant Special Agent in Charge with Human and 
Health Services Office of Inspector General. I am stationed in 
Miami and currently supervise agents assigned to the Medicare 
strike force, and prior to assuming my position, I was a member 
of one of the strike force teams. I am honored for the invitation and 
opportunity to discuss our efforts in combating health care fraud. 

This morning, I am here to tell you what our agents and I experi- 
ence as criminal investigators on the front line in this fight against 
health care fraud. Although the vast majority of Medicare pro- 
viders are honest, my job and our job is to focus on those intent 
on stealing from the program. My squad is actively engaged in 
criminal investigations, testifying before grand juries, executing 
search and arrest warrants and seizing bank accounts. 

Medicare fraud is discussed openly on the streets of south Flor- 
ida because it is accepted as a safe and even way to get rich quick. 
Now, the money involved in staggering. We see high school drop- 
outs making anywhere from $100,000 to millions a year. Typically, 
we see business owners, health care providers, doctors and Medi- 
care patients participate in the fraud but now we see drug dealers 
and organized criminal enterprises joining in. 

Today I will describe the typical fraud scheme, highlight Miami’s 
investigative model, share success stories, and finally discuss the 
evolution of fraud in south Florida. 

Now, prior to the state of the strike force, Miami was riddled 
with sham DME companies whose owners had one idea in mind: 
steal from the program. In order to perpetrate the fraud, nominee 
owners were recruited to place their names on corporate docu- 
ments, lease agreements and corporate bank accounts, and in ex- 
change were paid between $10,000 to $20,000. Stolen patient infor- 
mation was obtained from corrupt employees at hospitals, clinics 
and doctors’ offices. They also obtained lists of stolen physician 
identifiers, and with these two key pieces of information submitted 
fraudulent claims to Medicare for equipment that was never pro- 
vided. Once the money was deposited into the account, it was with- 
drawn within days. The idea was to deplete the account so that by 
the time Medicare even realized that there was a fraud, there was 
no money left to recover. 

These schemes are executed within a matter of months so we de- 
veloped a streamlined investigative approach to HEAT investiga- 
tions. The model includes the following steps to help identify our 
targets: quickly obtain and analyze Medicare claims, identify and 
obtain banking information, obtain the corporate documents, and 
identify the medical billing agent. 

Now, the following examples highlight the successes of our 
model. Two months ago, one of our agents received information 
from a confidential source that a DME company was submitting 
fraudulent claims. Through data analysis, we saw that $1.5 million 
was billed in just 3 weeks after a corporate change of ownership. 
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Further data analysis showed that this company and another that 
we had under investigation was billing for about the same 100 pa- 
tients, so within 30 days the agents corroborated that fraud was 
taking place and we were able to arrest the target. Using this 
model, he got zero money. When we arrested him, we found a fake 
driver’s license and learned that he was about to purchase yet an- 
other company under this assumed identity. 

In another example, a source alleged a corporation owning sev- 
eral community mental health centers was paying patients to allow 
them to bill for services they were not receiving. Data analysis and 
other investigative techniques led to five individuals being indicted 
and arrested and seven search warrants being executed simulta- 
neously. Now, 2 weeks ago, we indicted and arrested another 20 in- 
dividuals associated with this corrupt corporation and those ar- 
rested included center directors, physicians, therapists, patient re- 
cruiters and money launderers. The photographs you see are of the 
lavish estate of a patient recruiter who also laundered money for 
the corrupt corporation. We are finding that criminals have mi- 
grated to other services within the Medicare program including 
home health, community mental health centers, physical and occu- 
pational therapy. Historically, Medicare patients and doctors were 
not involved but now we are finding that in many cases both are 
getting paid to participate in the fraud. 

Additionally, not only are we seeing criminals migrate to other 
parts of the State but we know that they have migrated to States 
adjacent to Florida and other parts of the country like Georgia, 
North Carolina, Tennessee, West Virginia and Michigan. 

Thank you very much for the opportunity to discuss strike force 
operations in the south Florida and the investigative model that we 
utilize to protect the taxpayers interest, and I certainly welcome 
the opportunity to address any questions the panel has. 

[The prepared statement of Mr. Perez follows:] 
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Testimony of: 
Omar Perez 
Assistant Special Agent in Charge 
Office of Inspector General 
U.S. Department of Health & Human Services 


Good morning Chairman Steams, Ranking Member DeGette, and distinguished members 
of the Subcommittee. I am Omar Perez, an Assistant Special Agent in Charge (ASAC) 
with the U.S. Department of Health & Human Services’ (HHS) Office of Inspector 
General (OIG). I am stationed in the Miami Regional Office, and currently supervise 
Agents assigned to the Medicare Fraud Strike Force. I was formerly a member of one of 
the Strike Force teams prior to my assuming the position of ASAC. I am honored to have 
the opportunity to discuss OIG’s efforts in combating Medicare and Medicaid fraud, 

I am here this morning to tell you what our agents experience as criminal investigators on 
the front-line in the fight against health care fraud. Although the vast majority of 
Medicare providers are honest, my job is to focus on those who steal from the program. 
My squad is actively engaged in investigating criminal health care fraud, executing 
search and arrest wturants, seizing bank accounts, and providing Grand Jury testimony in 
the pursuit of criminal indictments. 

In South Florida, Medicare fraud is not only perpetrated by independent, scattered 
groups, but also by competitive, organized businesses complete with hierarchies and 
opportunities for advancement. Medicare fi'aud is discussed openly on the streets and is 
accepted as a safe and easy way to get rich quick. 

Who commits this fraud? People from all walks of life — they say it’s easy money and 
it’s safer than dealing drugs. I see people who never finished high school living lavish 
lifestyles, making anywhere from $100,000 to millions of dollars a year by committing 
Medicare fraud. The money involved is staggering. We see business owners, health care 
providers and suppliers, doctors, and Medicare beneficiaries participating in the fraud. 

We also see dmg dealers and organized criminal enterprises defrauding the system. 

How much money is involved? Way too much! As an example, I will tell you a little 
later about an investigation I supervise in which over $200 million was billed to Medicare 
in just 2 years. 

In my testimony today, I will describe a typical Medicare fraud scheme that we 
investigate in Miami. I will then provide an overview of the Miami Strike Force 
investigative approach from an agent’s perspective. I will share examples of Miami 
Strike Force success stories. Finally, I will discuss the evolution of fraud in South 
Florida. 
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Common Durable Medical Equipment Fraud Schemes Pre-Strike Force 

Prior to the start of the Strike Force, South Florida was riddled with sham durable 
medical equipment (DME) companies. Some of these companies started out as 
legitimate operations with a Medicare billing number; however, they were unsuccessful 
as the market was saturated with illegitimate DME companies. As a result, these 
companies were sold and, all too often, their new owner(s) had one idea in mind: steal 
from Medicare. 

Once in the hands of criminals, these companies no longer provided legitimate services. 

In order to perpetrate the fraud, “nominee owners”' were recruited. The names of these 
nominee owners were placed on corporate documents, lease agreements, and corporate 
bank accounts. Those perpetrating the fraud then obtained lists of stolen Medicare 
beneficiary information which were compiled by individuals with access to patient 
information, such as employees of hospitals, clinics, and physicians’ offices. The 
criminals also obtained lists of stolen Unique Physician Identification Numbers (UPIN) 
assigned to physicians by the Centers for Medicare & Medicaid Services (CMS). UPfNs 
are essential to the completion of a Medicare claim for reimbursement. With these two 
key pieces of information, the nominee owners would submit fraudulent claims to 
Medicare for DME that was never provided. The types of equipment ranged from 
nebulizers and corresponding medications, to incontinence supplies, to motorized 
wheelchairs. 

Once CMS paid the claims and deposited money into the company’s bank account, it was 
withdrawn within days using multiple check cashers. The idea was to deplete the account 
so that once Medicare discovered the fraudulent billing, which could take 6 months to 
1 year, there would be no money in the account. 

Miami Strike Force Approach to Combating Fraud 

The DME fraud schemes described above were executed within a matter of months. 

After billing Medicare for millions of dollars, companies would change ownership, bill 
Medicare again for millions of dollars, close, and simply take over another company and 
repeat the process in another location. By the time traditional investigative referral 
methods came to fhiition, criminals had absconded with millions of taxpayer dollars. 

The Health Care Fraud Prevention and Enforcement Action Team (HEAT) initiative, 
established by Secretary Kathleen Sebelius and Attorney General Eric Holder in May 
2009, is a joint effort by HHS and DOJ to leverage resources and expertise to prevent 
fraud, waste, and abuse in Medicare and Medicaid. A critical component of HEAT is the 
Medicare Fraud Strike Force. 


' A nominee owner is an individual who is recruited and paid by the true owner to be the owner of record 
for a DME company. This process occurs to protect the identity of the true owner. 
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A streamlined investigative approach was created for Strike Force investigations.’ The 
Strike Force model is a collaborative effort between the Department of Justice (DOJ) and 
HFIS. Each Strike Force team includes agents from FIHS OIG and the Federal Bureau of 
Investigation, as well as attorneys from DOJ. The teams are supported by Investigative 
Analysts, as well as CMS program experts and contractors, Miami has 10 Strike Force 
teams dedicated to investigating the wide array of Medicare fraud such as HW infusion 
therapy, physical and occupational therapy, DME, home health agencies, and Community 
Mental Health Centers to name a few. 

The individual investigations generally follow a model that has proved highly successful 
in these fraud schemes. The model includes the following steps: (1) analyze and evaluate 
claims data; (2) obtain the Medicare enrollment application; (3) identify the medical 
biller; (4) identify and obtain bank information; and (5) identify the “true” owner of the 
Medicare provider that is under investigation. 

Analyze and Evaluate Claims Data 

We now have the ability to stop the payment of a significant amount of money and catch 
the criminals before they and the money disappear. Strike Force team members receive 
Medicare billing data gleaned from a wide variety of CMS data systems. We analyze the 
data to identify aberrant billing patterns. Before Strike Force teams were initiated, the 
referrals we received contained billing data that were typically between 6 months to 1 
year old. Today, the data we receive provide billing information that is only 2 to 3 weeks 
old. In South Florida, as elsewhere, criminals can receive several hundred thousand 
dollars in fraudulent payments within a matter of weeks. The ability to retrieve recent 
data allows us to potentially obtain evidence immediately to substantiate fraudulent 
activity. The claims data can help us identify important information in assessing whether 
a fraudulent scheme is underway, including: 

• total amount paid 

• dates of service 

• referring/ordering physicians 

• beneficiaries 

• claim dates 

• types of procedures billed 

• place of service 

• provider banking information, and 

• ownership status. 

This process is called developing an investigative snapshot^ of the suspected fraudulent 
activity. 


^ “Snapshot” refers to an excerpt of a provider’s or supplier’s billing history that includes total amount 
billed and paid, claims denied, patient name, referring physicians, procedural codes billed, dates of service 
and place of service. 
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Obtain the Medicare Enrollment Application and Other Data 

Obtaining the Medicare enrollment application is extremely important because it 
identifies the registered owner, his or her financial institution, and the authorized medical 
billing representative. For investigators, this information can generate countless leads to 
other co-conspirators involved in the fi-audulent activity. 

Identify the Medicare Medical Biller 

The Medicare billing process begins when the medical biller electronically submits the 
patient’s information to a Medicare claims contractor for processing and reimbursement. 
The medical biller could be an employee of the fraudulent company and/or a contracted 
third party. It is important for investigators to interview the medical biller to determine 
his or her level of complicity, if any, and identify who provided the billing information. 

Identify the Bank Account and Financial Institution of the Fraudulent Business 

A critical investigative step is determining the true owner of the fraudulent provider’s 
bank account. In many instances, the true owner is not the individual who opened the 
bank account, withdrew or transferred funds, and/or cashed the Medicare checks. It is a 
significant step for investigators to identify and interview all individuals with signatory 
control over these accounts. 

Identify the "true “ owner of the clinic and/or DME company 

Strike Force members utilize commercial databases, bank account data, and informants in 
an effort to identify the true owners of the company. Once the true owner is identified. 
Strike Force members will attempt to interview the true owner. 

Typically, a nominee owner is paid $10,000 to $20,000 for his or her role. Our sources 
have told us that nominee owners have been recruited in other countries and travel to 
South Florida solely for this purpose. After being paid, they return to their native 
countries. 

Miami Strike Force Success Stories 

I offer the following examples that highlight the successes of our streamlined 
investigative strategy: 

One of our Agents received information from a confidential source that a DME company 
was submitting fraudulent claims. TTuough data analysis, we saw that there was an 
aberrant billing spike just after a corporate change of ownership took place: $1.5 million 
billed in just 3 weeks. Further data analysis showed that this company was billing for 
about 100 patients that another company we have under investigation was also billing for. 
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With a few interviews, the Agents corroborated that fraud was taking place, and within 
30 days we were able to arrest our target. Using this approach, we were able to prevent 
any Medicare funds from reaching the subject’s hands. After the arrest, the Agents 
learned that he was using a false Identity and was about to purchase yet another company. 
The investigation continues. 

In another example, OIG Agents received information from a confidential source that a 
corporation owning several Community Mental Health Centers (CMHC) was billing 
Medicare for services that patients were not receiving or did not qualify for to the tune of 
$200 million. The owner and managers of this corporation offered and paid kickbacks 
and bribes to patient recruiters to recruit Medicare beneficiaries to attend the 
corporation’s CMHCs and allow Medicare to be billed for services purportedly provided 
to them. The patients in turn were paid by the patient recruiters. Data queries were 
performed, interviews conducted, and within 45 days we secured a criminal indictment 
charging the center’s owner and managers with health care fraud. In October of last year, 
we executed five arrest warrants and seven search warrants. 

The information obtained in the CMHC investigation led to another indictment this year. 
In February, our enforcement operation resulted in the arrest of 20 individuals ranging 
from physicians, therapists, clinic directors, patient recruiters, and money launderers. 
Physicians purportedly falsified medical records, and clinic directors allegedly directed 
the patient recruiters and money launderers. As part of this operation, we reached out to 
seven other OIGs to assist in the arrest operation using the mutual assistance program 
previously mentioned by Deputy Inspector General for Investigations Roy. Utilizing this 
collaborative and cost-efficient approach, we were able to arrest 60 subjects in Miami 
connected to stealing millions of dollars from the Medicare trust fund. This investigation 
is ongoing. 

The Evolution of Fraud in South Florida 

In many instances, criminals have shifted their schemes from purchasing legitimate DME 
companies to instead establishing storefront shams. The storefronts are set up by 
criminals who have the required equipment to pass Medicare onsite inspections. Once 
the Medicare provider number has been issued, the individuals pick up their equipment 
and all that remains is an empty storefront. 

Some criminals create additional layers to shield the true owners to counter Strike Force 
tactics. Prior to Strike Force operations, the true owner was most likely an associate of 
the nominee owner. Now there are many levels to their criminal enterprises; each level 
operating independently of the others but controlled by the same person(s). 

We found that criminals are now migrating to other services within the Medicare 
program to perpetrate their fraud. Other services impacted include home health, 
community mental health, and physical and occupational therapy. OIG is aggressively 
addressing these areas. Historically, Medicare beneficiaries and physicians were not 
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typically involved in these types of criminal enterprise. Now we know that in more and 
more cases both are getting paid to participate in fraud. 

Conclusion 

The investigative approach and success stories referenced today represent the dedication 
and commitment of all OIG Special Agents and our collaborative partners in the fight 
against fraud within the Medicare and Medicaid insurance programs. The HEAT 
initiative illustrates how combined resources, technology, and collaboration can be 
synthesized to combat health care fraud to protect vulnerable Americans. 

Thank you for the opportunity to discuss Strike Force operations in South Florida, and 
the strategies and investigative methods utilized to protect the interest of all taxpayers. I 
would be happy to answer any questions that the Subcommittee may have. 
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Mr. Stearns. Thank you, Mr. Perez. 

Mr. Spiegel. 

STATEMENT OF JOHN SPIEGEL 

Mr. Spiegel. Thank you. Chairman Stearns, Ranking Member 
DeGette and members of the subcommittee, thank you very much 
for the invitation to discuss the Centers for Medicare and Medicaid 
Services’ efforts to reduce fraud, waste and abuse in the Medicare, 
Medicaid and Children’s Health Insurance programs and the new 
tools and authorities provided in the Affordable Care Act. I am 
happy to be here today appearing on behalf of Peter Buddetti, who 
is the Director of the Center for Program Integrity where I work 
as the Director of the Medicare Program Integrity Group. 

Dr. Buddetti said from the beginning of the time on his job that 
people are asking two questions repeatedly: why do you let the 
perps into Medicare and Medicaid and why do you continue to pay 
fraudulent claims? Well, I can tell you that with the new authori- 
ties provided in the recent laws and the commitment of the Admin- 
istration in fighting fraud, we are making progress on both fronts. 
Our approach will be keeping people who don’t belong in the pro- 
grams out and we will be kicking out fraudulent claims before they 
are paid. We now have the flexibility to tailor resources to address 
the most serious problems and quickly initiate activities in a trans- 
formative way. 

Under the leadership of Secretary Sebelius, CMS has taken a 
number of administrative steps to better meet emerging needs and 
challenging in fighting fraud and abuse. For example, CMS consoli- 
dated the Medicare and Medicaid Program Integrity Groups under 
a unified Center for Program Integrity to pursue a more strategic 
and coordinated set of program integrity policies and activities 
across both programs. This change in structure and focus served 
our program integrity well and has facilitated collaboration on anti- 
fraud initiatives with our law enforcement partners in the HHS Of- 
fice of Inspector General and in the Department of Justice and 
State Medicaid fraud control units as well. And just last week we 
restructured the center to provide some additional concentrated 
focus on the new initiatives that I will be talking about in a little 
bit, some examples being increased focus on data development and 
uses of analytics that will help bolster our work. 

The Affordable Care Act enhanced this organizational change by 
providing an opportunity to develop policies across all of our pro- 
grams jointly. The act’s division such as enhanced screening re- 
quirements for new providers and suppliers apply across all the 
programs, not just for Medicare and not just for Medicaid. They are 
uniform across the board. This ensures consistency obviously as 
one of the goals that we try to pursue in our fraud and abuse ac- 
tivities. 

So many might argue that just rearranging the boxes doesn’t 
have much of a value but we think that having created a Center 
for Program Integrity, it is on a par with other major operating 
components within CMS. It sends a powerful message that the Ad- 
ministration is seriously committed to fighting fraud and it puts 
the bad actors on notice, and because most success in anything 
comes from clarity of purpose, we have made certain that our 
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sights are firmly fixed on the goal of ensuring correct payments are 
made to legitimate providers for covered, reasonable and appro- 
priate services for eligible beneficiaries. 

I would like to take a little time today to explain how we have 
been transforming our fraud detection and prevention work 
through the new approach on the poster over there. So first, central 
to our goal is the shift away from identifying fraud before it hap- 
pens. We want to prevent things from taking shape. We want to 
move away from “pay and chase” that we have relied on so heavily 
in the past. Second, we don’t want to be limited to a monolithic ap- 
proach to fighting fraud. Instead, we want to focus our efforts on 
the bad actors who pose elevated risk. Third, we are taking advan- 
tage of innovation and technology as we move quickly to take ac- 
tion focused on prevention when possible. And fourth, consistent 
with the Administration’s commitment to being transparent, we 
are developing performance measures that will specify our targets 
for improvement. We are actively engaging public and private part- 
ners from across the spectrum because there is obviously much to 
learn from others who engaged in the same endeavor of fighting 
fraud. We know the private sector is victimized by the same 
schemes we see in public programs in collaboration and commu- 
nication among all parties. And finally, we are committed to coordi- 
nation and integration of our activities across all the programs in 
CMS based on best practices and lessons learned. 

So as we move away from the old ways to more modern and so- 
phisticated successful approaches, we are continuing to concentrate 
our actions 

Mr. Stearns. Just if you can, sum up. Your time is over. 

Mr. Spiegel. OK. Sorry. 

Mr. Stearns. Thank you. 

Mr. Spiegel. Let me just get through this one particular part 
and I will be finished. 

Mr. Stearns. Can you just summarize? 

Mr. Spiegel. Sure. We want to do a better job of keeping people 
out before they get in. We want to move quickly when we see those 
who have gotten in that are potentially improper bills and take 
steps to reduce claims payment error by 50 percent and get people 
out who don’t belong. 

[The prepared statement of Mr. Spiegel follows:] 
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U.S. House Committee on Energy & Commerce, 

Subcommittee on Oversight and Investigations 
Hearing on “Waste, Fraud and Abuse: A Continuing Threat to Medicare and 

Medicaid” 

March 2, 2011 

Chairman Steams, Ranking Member DeGette, and Members of the Subcommittee, thank 
you for the invitation to discuss the Centers for Medicare & Medicaid Services’ (CMS) 
efforts to reduce fraud, waste, and abuse in Medicare, Medicaid, and the Children’s 
Health Insurance Program (CHIP) and the new tools and authorities provided in the 
Affordable Care Act. 

As CMS implements the new authorities in the Affordable Care Act, we have a 
significant opportunity to enhance our existing efforts to combat fraud, waste, and abuse 
in Federal health care programs. These new authorities offer more front-end protections 
to keep those who are intent on committing fraud out of the programs and new tools for 
deterring wasteful and fiscally abusive practices, identifying and addressing fraudulent 
payment issues promptly, and ensuring the integrity of Medicare, Medicaid, and CHIP. 
CMS is pursuing an aggressive program integrity strategy that seeks to prevent payment 
of fraudulent claims, rather than chasing fraudulent providers after a payment has been 
made. CMS now has the flexibility to proactively tailor resources and quickly initiate 
activities in a transformative way. We believe the Affordable Care Act provisions will 
greatly support the effectiveness of our work. This historic moment also presents CMS 
with a valuable opportunity to partner with the private sector and collaborate on fraud 
detection efforts based on tools and methods that are already succeeding in other sectors. 

CMS recognizes the importance of having strong program integrity initiatives that will 
deter and end criminal activity that attempts to defraud Federal health care programs. I 
share your commitment to ensuring taxpayer dollars are being spent on legitimate items 
and services, which is at the forefront of our program integrity mission. 
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Bringing Activities Together into the Center for Program Integrity 
CMS has taken several administrative steps to better meet the Agency’s future needs and 
challenges. CMS realigned its internal organizational structure last year, consolidating 
the Medicare and Medicaid program integrity groups under a unified Center for Program 
Integrity (CPI). This centralized approach has enabled CMS to pursue a more strategic 
and coordinated set of program integrity policies and activities across the Federal health 
care programs and has formed a bridge that facilitates collaboration on anti-fraud 
initiatives with our law enforcement partners, such as the Health and Human Services 
Office of Inspector General (OIG), the Department of Justice (DOJ), and State Medicaid 
Fraud Control Units. We are also working closely with our colleagues in the Office of 
the Secretary at HHS, as they implement the Secretary’s program integrity initiative 
across the department. We are actively sharing best practices and lessons learned as we 
move forward together. 

The Affordable Care Act enhances this organizational change by providing CMS with the 
ability to improve and streamline its program integrity capabilities by providing us with 
an opportunity to jointly develop Medicare, Medicaid and CHIP policy on these new 
authorities. For example, many Affordable Care Act provisions, such as enhanced 
screening requirements for new providers and suppliers, apply across the programs. The 
new integrated operation of program integrity activities within CMS ensures that there is 
better consistency in CMS’ approach to fraud prevention across all of our programs. 

Strategic Principles for Program Integrity Operations 

As we continue the process of implementing these authorities and strengthening the 
integrity of the Federal health care programs, we are mindful of the impact our new rules 
have on health care providers and suppliers, who are our partners in caring for 
beneficiaries and have the awareness needed to assist us in continuing to protect 
beneficiary access to necessary health care services, supplies or medication. CMS is 
committed to improving care for our beneficiaries and engaging States and law-abiding 
providers and suppliers to ensure our activities reflect their interests. As we seek to 
reduce fraud, waste, and abuse in Medicare, Medicaid, and CHIP, we are mindful of 
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striking the right balance between preventing fraud and other improper payments without 
impeding the delivery of critical health care services to beneficiaries. At their core, 
Federal health care programs are designed to provide affordable health care to families in 
need, people with disabilities, and aging Americans. Additionally, the vast majority of 
health care providers are honest people who abide by their legal and professional duties 
and provide critical health care services to millions of CMS beneficiaries every day. 

CMS is committed to providing health care services to beneficiaries, while reducing the 
burden on legitimate providers, targeting fraudsters and saving taxpayer dollars. 

This Administration is committed to minimizing fraud, waste, and abuse in Federal health 
care programs. While improper payments are not necessarily indicative of fraud, CMS is 
committed to reducing all waste within our programs. In order to focus on the prevention 
of improper payments while remaining vigilant in detecting and pursuing problems when 
they occur, we have increased provider education on proper documentation and are 
reexamining our claims payment and enrollment systems. With these efforts and others, 
we are confident that we will meet the President’s goal to reduce the Medicare fee-for- 
service error rate in half by 20 1 2, Moreover, we are implementing a number of measures 
that will shift our enforcement and administrative actions from a “pay and chase” mode 
to the prevention of fraudulent and other improper payments. This shift involves many 
different activities, which we are carrying out with the powerful new anti-fraud tools 
provided to CMS and our law enforcement partners under the Affordable Care Act. 

We are steadily working to incorporate targeted screening and prevention activities into 
our claims and enrollment processes where appropriate. Our goal is to keep those 
individuals and companies that intend to defraud Medicare, Medicaid, and CHIP out of 
these programs in the first place, not to pay fraudulent claims when they are submitted, 
and to remove such individuals and companies from our programs if they do get in. The 
first step to preventing fraud in the Federal health care programs is to appropriately 
screen providers and suppliers who are enrolling or revalidating their enrollment to verify 
that only legitimate providers and suppliers who meet our stringent enrollment standards 
are providing care to program beneficiaries. 
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CMS’ Efforts to Implement the Affordable Care Act 

New Actions - Medicare. Medicaid, and CHIP Screenim and Fraud Prevention Rule 
(CMS-6028-FC) 

On January 24, 201 1, HHS and CMS announced rules that implement new Affordable 
Care Act tools to fight fraud, strengthen Federal health care programs, and protect 
taxpayer dollars. This rule puts in place prevention safeguards that will help CMS move 
beyond the “pay and chase” approach to fighting fraud. 

Enhanced Screening and Enrollment Protections: The Affordable Care Act requires 
providers and suppliers who wish to enroll in the Medicare, Medicaid, or CHIP programs 
to undergo a level of screening tied to the level of risk of fraud, waste, or abuse such 
providers and suppliers present to the programs. This new rule will require high-risk 
providers and suppliers, including newly enrolling suppliers of Durable Medical 
Equipment, Prosthetics, Orthotics and Supplies (DMEPOS) and home health agencies, to 
undergo a higher level of scrutiny based on CMS’ and law enforcement’s experience with 
these provider and supplier types. CMS has also established certain triggers that would 
move a provider or supplier into the highest screening level. 

In addition, CMS-6028-FC implements the Affordable Care Act provision that authorizes 
CMS to require that providers who order and refer certain items or services for Medicaid 
beneficiaries be enrolled in the State’s Medicaid program; this is similar to the new 
Medicare requirement included in an interim final rule published this past spring, CMS- 
6010-IFC, described in more detail below. 

This new rule implements the statutory authority for CMS to impose a temporary 
enrollment moratorium if the Secretary determines such a moratorium is necessary to 
prevent or combat fraud, waste, or abuse. We will assess the impact of any proposed 
moratorium on beneficiary access and take this into consideration. We will publish a 
notice of the moratorium including a rationale for the moratorium in the Federal 
Register. Other preventive measures include new levels of coordination between 
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Medicare and State Medicaid agencies. For example. State Medicaid programs are now 
required to terminate a provider that has been terminated for cause by Medicare or 
another State Medicaid agency. 

Stopping Payment of Suspect Claims: CMS-6028-FC allows Medicare payments to be 
suspended from providers or suppliers if there is a credible allegation of fraud pending an 
investigation or final action. The law also requires States to suspend payments to 
Medicaid providers where there is a credible allegation of fraud. This enhanced authority 
will help prevent taxpayer dollars from being used to pay fraudulent providers and 
suppliers. 

New Resources to Strengthen Program Integrity: The Affordable Care Act provides 
an additional $350 million over 10 years, plus an inflation adjustment, to ramp up 
program integrity efforts in HHS’ Health Care Fraud and Abuse Control program 
(HCFAC) account, including the Medicare Integrity Program, as well as the Medicaid 
Integrity Program. These dedicated Affordable Care Act funds provide important 
financial resources for government-wide health care fraud and abuse efforts for the next 
decade, which will be used along with discretionary funding sought in the President’s 
Budget to pursue critical new prevention-focused activities, place more “feet on the 
street” by hiring more law enforcement agents, and facilitate other efforts to reduce 
improper payments and address emerging fraud schemes in the health care system. 

Other Implementation Steps - CMS-6010-IFC 

CMS published an interim final rule with comment period (CMS-6010-IFC) in the 
Federal Register on May 5, 2010 that implemented some new anti-fraud authorities and 
provisions of the Affordable Care Act. This rule, which took effect July 6, 2010, requires 
all providers of medical or other items or services and suppliers that qualify for a 
National Provider Identifier (NPI) to include their NPl on all applications to enroll in 
Federal health care programs and to also include their NPl on all claims for payment 
submitted to Medicare and Medicaid. CMS-6010-IFC also requires that physicians and 
eligible professionals who order or refer home health services or most Medicare Part B- 
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covered items and services for Medicare fee-for-service beneficiaries be enrolled in 
Medicare. In addition, it adds requirements for providers, physicians, and suppliers 
participating in the Medicare program to provide access and maintain documentation on 
orders or requests for payments for items or services at high risk of fraud, waste, and 
abuse, such as DMEPOS, home health services, and certain other items or services as 
specified by the Secretary. 

Other Affordable Care Act Authorities 

There are many other Affordable Care Act program integrity provisions that we will also 
be busy implementing this year. For example, CMS will be issuing additional surety 
bond requirements under the Affordable Care Act for DMEPOS suppliers and home 
health agencies and potentially for certain other providers of services and supplies. These 
surety bonds are a condition of enrollment and may help ensure that DMEPOS suppliers 
and home health agencies, and potentially certain other providers of services and 
supplies, are legitimate and financially solvent. 

In addition, providers and suppliers will be required to establish compliance plans that 
contain certain anti-fraud requirements and reflect good governance practices. Such 
plans will help ensure that providers and suppliers have incorporated anti-fraud 
protections into their operations. Other preventive measures focus on certain categories 
of providers and suppliers that historically have presented concerns to our program 
including DMEPOS suppliers, home health agencies, and Community Mental Health 
Centers (CMHCs). For example, as an additional safeguard to address longstanding 
concerns with CMHCs, such facilities will be required to provide at least 40 percent of 
their items and services to non-Medicare beneficiaries. 

Expanded Use of Recovery Audit Contractors 

CMS is drawing from the lessons learned from the Medicare Fee-For-Service (FFS) 
Recovery Audit Contractor (RAC) Program to implement the new statutory authority 
given in the Affordable Care Act to expand the program to Medicare Parts C and D and 
Medicaid. In order to address the fundamental differences in payment structure between 
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FFS, Medicare Part C(managed care). Medicare Part D and State-run Medicaid programs, 
CMS has taken a multi-pronged approach to implementation of the new Affordable Care 
Act authorities. In January, CMS awarded a contract to identify incorrect payments and 
recoup overpayments in Medicare Part D. Additionally, we are seeking public comment 
through a solicitation issued on December 27, 2010 in the Federal Register on innovative 
strategies for review of additional Medicare Parts C and D data, including the 
effectiveness of sponsors’ anti-fraud plans. 

In the Medicaid program, CMS issued a State Medicaid Director letter in October 2010 
that offered initial guidance on the implementation of the Medicaid RAC requirements 
and published a Notice of Proposed Rulemaking on November 10, 2010. CMS has 
provided significant technical assistance to States through all-State calls and webinars 
and has begun the coordination with States that have RAC contracts in place, as required 
by the statute. CMS will also work to ensure that States and their Medicaid RACs 
coordinate recovery audits with other entities to minimize the likelihood of overlapping 
audits. On February 17, CMS launched a Medicaid RACs At-A-Glance web page on the 
CMS website. The page provides basic State RAC information to the public and 
interested stakeholders about each State’s RAC program. As States fully implement their 
programs and additional elements are added to the site in the future, the site will help 
States to monitor the performance of their own RAC program and find information on 
other States’ programs that may assist them. 

Increased Flexibility in Medicaid Recovery Rules 

CMS issued a State Medicaid Director letter in July 2010, providing initial guidance on 
the recovery of Medicaid overpayments as required by the Affordable Care Act. States 
now have up to one year from the date of discovery of an overpayment in Medicaid to 
recover, or attempt to recover, such overpayment before being required to refund the 
Federal share of the overpayment. Prior to passage of the Affordable Care Act, States 
were allowed only up to 60 days from the date of discovery of an overpayment to recover 
such overpayment before making the adjustment to the Federal share. CMS appreciates 
this new flexibility for States. The additional time provided under the Affordable Care 
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Act wili enable States to more thoroughly root out fraud and overpayments. However, 
for overpayments resulting from fraud, if an ongoing administrative or judicial process 
prevents a State from recovering an overpayment within one year of discovery, the State 
has an additional 30 days after a final judgment is made to recover the overpayment 
before making the adjustment to the Federal share. 

Guidance on Self-Disclosure of Actual or Potential Violations of Physician Self-Referral 
Statute 

In September 2010, CMS published the Voluntary Self-Referral Disclosure Protocol 
(SRDP) on its website to enable providers and suppliers to disclose actual or potential 
violations of the physician self-referral statute (Section 1877 of the Social Security Act). 
The SRDP contains instructions for providers and suppliers who make self-disclosures, 
and advises that the Affordable Care Act gives the Secretary the discretion to reduce the 
amount due and owing for a violation of the physician self-referral statute. The SRDP 
states the factors CMS may consider in reducing the amounts due and owing, including: 
(1) the nature and extent of the improper or illegal practice; (2) the timeliness of the self- 
disclosure; (3) the cooperation in providing additional information related to the 
disclosure; (4) the litigation risk associated with the matter disclosed; and (5) the 
financial position of the disclosing party. 

Fraud Detection and Reporting 

CMS has improved the processes for fraud detection by our contractors and for reporting, 
analyzing, and investigating complaints of potential fraud from beneficiaries. 

In order to take a more holistic approach to detecting and addressing fraud, CMS has 
worked to integrate the activities of the Program Safeguard Contractors (PSCs) into more 
comprehensive Zone Program Integrity Contractors (ZPICs). Before these reforms, each 
PSC focused on benefit integrity in limited parts of the Medicare program, making it 
possible for providers and suppliers to continue to submit fraudulent claims to one part of 
the Medicare program even after questionable claims had been identified in another part 
of the program. Instead, CMS is currently in the process of contracting with one ZPIC in 
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each of seven separate geographic zones, with an emphasis on designated high fraud 
areas. Unlike PSCs, ZPICs perform program integrity functions for all parts of 
Medicare. These contracting reforms have allowed CMS to break down silos in program 
integrity work and better identify potentially fraudulent behavior across all parts of the 
Medicare program. 

Another of these fraud detection improvements involves modifications to the 1-800- 
MEDICARE call center procedures. In the past, if a caller reported that they did not 
recognize a provider or did not receive the service documented on their Medicare 
Summary Notice form, they were asked to follow up with the provider prior to filing a 
fraud complaint. However, now 1 -800-MEDICARE will review the beneficiary’s claims 
records with them and if the discrepancy is not resolved, we will take action and file a 
complaint immediately, regardless of whether the caller has attempted to contact the 
provider. Also, CMS is using the information from beneficiaries’ complaints in new 
ways. For instance, CMS is generating weekly “fraud complaint frequency analysis 
reports” that compile provider-specific complaints and flag providers who have been the 
subject of multiple fraud complaints for a closer review. This is just one example of 
CMS shifting our use of available data in more intuitive ways. 

As part of our commitment to applying innovative analytics to existing data sources to 
prevent fraud, CMS has developed the capability to map shifts and trends in fraud 
allegations reported to 1 -800-MEDICARE overtime using geospatial maps and 
sophisticated data tools. These tools will allow CMS to gather more information from 1- 
800-MEDICARE calls for data analysis. The various parameters include claim type, 
geographic location, and fraud type. CMS is also exploring new options for streamlining 
the process and timeframe for investigating fraud complaints, while seeking to preserve 
the efficiencies and cost-effectiveness of a single call center like 1 -800-MEDICARE. 

Fiscal Year 2012 Budget Request 

To continue the Administration’s focus on fraud prevention and to build on the new 
authorities and resources provided by the Affordable Care Act, the President’s Fiscal 
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Year 2012 Budget Request includes a package of program integrity legislative proposals 
across Medicare, Medicaid and CHIP that will save $32,3 billion over 10 years. These 
proposals, if enacted, would provide CMS with additional tools to reduce and prevent 
improper payments and ensure that those committing fraud are held responsible and 
cannot easily discharge their debts or reenter our programs to commit additional offenses. 

In addition, the FY 2012 Budget Request also includes a little over $1.85 billion for the 
HCFAC account, including mandatory and discretionary sources, divided between CMS’ 
programs and our law enforcement partners at the OIG and DOJ. The FY 2012 
discretionary HCFAC request is $581 million, a $270 million increase over the FY 2010 
enacted level. Described in more detail below, these new HCFAC resources would 
support and advance the goals of the Health Care Fraud Prevention and Enforcement 
Action Team (HEAT) initiative, a joint Cabinet-level effort established by the President 
and led by Secretary Sebelius and Attorney General Holder. The Budget Request is 
necessary to continue expanding the Medicare Fraud Strike Force — an integral part of 
HEAT, described below — to as many as 20 areas, as well as civil health care fraud 
enforcement activities. Further, if provided by Congress, this discretionary HCFAC 
funding will allow us to expand prevention and detection activities and work to reduce 
improper payments with aggressive pre-payment review, increased provider education, 
and the development of a national pre-payment edit module. 

HCFAC Prosram Successes 

HCFAC has been steadily growing since it began in 1997 and, as shown in the recently 
released FY 2010 HCFAC report, this investment in fraud fighting resources is paying 
dividends. The HCFAC report demonstrates the value of this program; since its inception 
and through FY 2010, HCFAC has resulted in the return of $18 billion to the Medicare 
trust funds. In FY 2010 alone, $2.8 billion was returned to the Medicare trust funds and 
$683 million was returned to the Federal Treasury from Medicaid recoveries. The 
HCFAC return-on-investment (ROI) is currently the highest it has ever been; the 3 year 
rolling ROI (FY 2008- FY 2010) averaging all HCFAC activities is $6.8 to $1; this is 
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$1.9 more than the historical average. Additionally, the ROI for the Medicare Integrity 
Program’s activities is 14 to 1. 

HCFAC funds support HEAT and many complementary anti-fraud initiatives, including: 

• DOJ-FBI-HHS-OIG-Medicare Strike Forces: This coordinated effort is needed 
in order to focus enforcement resources in geographic areas at high risk for fraud. 
Strike Force cases are data driven, using technology to pinpoint fraud hot spots 
through the identification of unusual billing patterns as they occur. 

• Increased Prevention and Detection: CMS is committed to working with law 
enforcement to efficiently use existing systems and eollaborate on future 
improvements, and has provided numerous training sessions for law enforcement 
personnel on CMS data analytic systems. Further, CMS will do rapid response 
projects as well as long-term in-depth studies. 

• Expanded Law Enforcement Strategies: HCFAC will further expand existing 
criminal and civil health care fraud investigations and prosecutions, particularly 
related to fraud schemes in areas such as pharmaceutical services, medical 
devices, and durable medical equipment, as well as newly emerging schemes. It 
will allow the use of cutting-edge technology in the analysis of electronic 
evidence to better target and accelerate enforcement actions. Finally, the increase 
will expand Medicare and Medicaid audits and OlG’s enforcement, investigative, 
and oversight activities. 

• Oversight: HCFAC will help to further strengthen oversight in Medicare, 
Medicaid, and CHIP. 

We are excited about the tools and resources available to CMS through HCFAC. In 
particular, because of changes in the Affordable Care Act, we will now have flexibility to 
utilize HCFAC funds to enhance our own expertise for pursuing fraud, waste, and abuse 
in Medicare. 


II 



64 


Engaging Our Beneficiaries and Partners 

Meanwhile, HHS and CMS continue to work with and rely on our beneficiaries and 
collaborate with our partners to reduce fraud, waste, and abuse in Medicare, Medicaid 
and CHIP. The Senior Medicare Patrol (SMP) program, led by the Administration on 
Aging (AoA), empowers seniors to identify and fight fraud through increased awareness 
and understanding of Federal health care programs. This knowledge helps seniors protect 
themselves from the economic and health-related consequences of Medicare and 
Medicaid fraud, waste, and abuse. In partnership with State and national fraud 
control/consumer protection entities, including Medicare contractors, State Medicaid 
Fraud Control Units, State Attorneys General, the HHS OIG, and CMS, SMP projects 
also work to resolve beneficiary complaints of potential fraud. Since the program’s 
inception, the program has educated over 3.84 million beneficiaries in group or one-on- 
one counseling sessions and has reached almost 24 million people through community 
education outreach events. CMS is partnering with AoA to expand the size of the SMP 
program and put more people in the community to assist in the fight against fraud. 

In addition to working with AoA on expanding the SMPs, CMS is implementing a 
number of new mechanisms to better engage beneficiaries in identifying and preventing 
fraud. As part of that effort, CMS encourages its beneficiaries to check their Medicare 
claims summaries thoroughly. Medicare Summary Notices (MSNs) are sent to 
beneficiaries every 90 days; CMS is working with beneficiaries to redesign the MSNs to 
make them easier to understand so beneficiaries can spot potential fraud or overpayments 
on claims submitted for their care. Additionally, some 10 million beneficiaries are 
enrolled into www.mymedicare.gov, a secure website, and can now check their claims 
within 24 hours of the processing date. This information is also available through the 1- 
800-MEDICARE automated system. A fact sheet and informational card have been 
developed to educate and encourage beneficiaries or caregivers to check their claims 
frequently and to report any suspicious claims activity to Medicare. These materials are 
being used at the regional fraud prevention summits (described below) and have been 
shared with both State Health Insurance Plans (SHIPs) and SMPs. 
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Further, CMS is implementing a number of new educational and awareness initiatives in 
identifying and preventing fraud among those Americans who receive services under the 
Medicaid program. 

Collaborating with Law Enforcement Partners 

CMS is committed to working with our law enforcement partners, who take a lead role in 
investigating and prosecuting alleged fraud. CMS provides support and resources to the 
Strike Forces, which investigate and track down individuals and entities defrauding 
Medicare and other government health care programs. Strike Force prosecutions are 
“data driven” and target individuals and groups actively involved in ongoing fraud 
schemes. These efforts started in Miami in 2007and expanded to Los Angeles in 2008. 

In 2009 and 2010 under the FIEAT initiative, we continued expanding the Strike Force to 
Detroit, Houston, Brooklyn, Tampa and Baton Rouge using the additional discretionary 
funding that Congress provided in response to the President’s budget requests. On 
February 17, 201 1, we announced further expansion of Medicare Fraud Strike Force 
operations to Dallas and Chicago. FIEAT has enhanced coordination of anti-fraud efforts 
of DOJ’s Civil and Criminal Divisions and U.S. Attorneys’ Offices, FBI, HHS/OIG and 
CMS. The HEAT task force is working to identify new enforcement initiatives and areas 
for increased oversight and prevention, including how to increase efficiency in 
pharmaceutical and device investigations. 

The Strike Force model has been very successful. Since its inception. Strike Force 
operations in nine cities have charged more than 990 individuals who collectively have 
falsely billed the Medicare program for more than $2.3 billion. This figure includes the 
Medicare Strike Force’s latest successes, announced on February 17, 2011, charging 1 1 1 
individuals with more than $225 million in false Medicare billing. 

Sharing information and performance metrics broadly and engaging internal and external 
stakeholders requires establishing new partnerships with government and private sector 
groups. Because the public and private sectors have common challenges in fighting fraud 
and keeping fraudulent providers at bay, it makes sense that we should work together to 
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develop common solutions. In addition to the HEAT initiative, agencies including HHS, 
CMS, OIG, and DOJ have co-hosted a series of regional summits on health care fraud 
prevention. 

Building on the momentum generated by the National Health Care Fraud Summit in 
January 2010, regional health care fraud prevention summits have been held across the 
country. These summits, held to date in Miami, Los Angeles, New York, and Boston 
with plans for additional cities, brought together Federal and State officials, law 
enforcement experts, private insurers, beneficiaries, caregivers, and health care providers 
to discuss innovative ways to eliminate fraud within the nation’s health care system. 
These summits also featured educational panels that discussed best practices for 
providers, beneficiaries and law enforcement in preventing health care fraud. The panels 
included law enforcement officials, consumer experts, providers and representatives of 
key government ageneies. CMS looks forward to continuing these summits in 201 1 as 
well as more opportunities to bring these stakeholder communities together in other cities 
to continue this important dialogue and strengthen our cooperative efforts across the 
Federal government and with the private sector. 

Data Analytics 

The Affordable Care Act also requires increased data sharing between Federal entities to 
monitor and assess high risk program areas and better identify potential sources of fraud. 
CMS is expanding its Integrated Data Repository (LDR) which is currently populated 
with five years of historical Part A, Part B and Part D paid claims, to include near real 
time pre-payment stage claims data; this additional data will provide the opportunity to 
analyze previously undetected indicators of aberrant activity throughout the claims 
processing cycle. CMS intends to develop shared data models and is pursuing data 
sharing and matching agreements with the Department of Veterans Affairs, the 
Department of Defense, the Social Security Administration, and the Indian Health 
Service to identify potential waste, fraud, and abuse throughout Federal health care 
programs. Also, the Affordable Care Act requirement that States report an expanded set 
of data elements from their Medicaid Management Information System (MMIS) will 
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strengthen CMS’ program integrity work both within State Medicaid programs and 
across CMS. This robust State data set will be harmonized with Medicare claims data in 
the IDR to detect potential fraud, waste and abuse across multiple payers. 

CMS will implement an innovative risk scoring technology that applies effective 
predictive models to Medicare. Innovative risk scoring technology applies a combination 
of behavioral analyses, network analyses, and predictive analyses that are proven to 
effectively identify complex patterns of fraud and improper claims and billing schemes. 
CMS is integrating the advanced technology as part of an end-to-end solution that 
triggers effective, timely administrative actions by CMS as well as referrals to law 
enforcement when appropriate. Prior to applying predictive models to claims 
prepayment, CMS will rigorously test the algorithms to ensure a low rate of false 
positives, allowing payment of claims to legitimate providers without disruption or 
additional costs to honest providers; confirm that the algorithms do not diminish access to 
care for legitimate beneficiaries; and identify the most efficient analytics in order to 
appropriately target resources to the highest risk claims or providers. Given the changing 
landscape of health care fraud, any successful technology will need to be nimble and 
flexible, identifying and adjusting to new schemes as they appear. 

As we pursue and test new technology, CMS is working to involve the private sector and 
State partners to incorporate strategies that have already proven successful. As the first 
phase of partnership building with private sector entities, CMS held an industry day in 
October 2010 that was attended by approximately 300 industry representatives. This 
event highlighted CMS’ strategic goals, priorities, and objectives in the use of 
information technology solutions for fraud prevention in our programs and provided an 
opportunity for attendees to determine whether their firm’s services, methods and 
products fit with CMS’ mission and vision. In December 2010, CPI issued a Request for 
Information asking vendors to identify their capabilities in the areas of provider 
screening/enrollment and data integration. CMS will review the responses and 
incorporate innovative ideas into the strategy for integrated, automated, providers 
screening and data integration. 
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Further, the Small Business Jobs Act of 201 0 provided $ 1 00 million, beginning in FY 
2011 to phase-in the implementation of predictive analytics in Medicare FFS, Medicaid, 
and CHIP over four years. The new predictive modeling technology will incorporate 
lessons learned through pilot projects. For example, in one pilot, CMS partnered with the 
Federal Recovery Accountability and Transparency Board (RATB) to investigate a group 
of high-risk providers. By linking public data found on the Internet with other 
information, like fraud alerts from other payers and court records, we uncovered a 
potentially fraudulent scheme. The scheme involved opening multiple companies at the 
same location on the same day using provider numbers of physicians in other states. The 
data confirmed several suspect providers who were already under investigation and, 
through linkage analysis, identified affiliated providers who are now also under 
investigation. 


Delivery System Reforms 

Beyond the traditional program integrity initiatives, the delivery system reforms created 
by the Affordable Care Act will further help to deter and prevent fraudulent activities 
within Medicare. When there are large disparities between the cost of goods and 
services, as compared to the allowed reimbursement, we know that these excessive 
payments often make Medicare a more attractive and lucrative target for those attempting 
to commit fraud. For instance, OIG, the Government Accountability Office (GAO), and 
other independent analysts have repeatedly highlighted that the fee schedule prices paid 
by Medicare for many DMEPOS items are excessive, as much as three or four times the 
retail prices and amounts paid by commercial insurers or cash customers. These inflated 
prices in turn increase the potential profits of those intending to defraud the Medicare 
program. To that end, CMS implemented supplier contracts and new payment rates 
based on the Round 1 rebid of DMEPOS competitive bidding on January 1, 201 1 in nine 
Metropolitan Statistical Areas. The Office of the Actuary estimates that once fully 
implemented this program is projected to save more than $17 billion in Medicare 
expenditures over ten years. Outside of DMEPOS, CMS is working to redesign our 
Medicare payment systems and institute delivery system reforms that will realign 
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Medicare payments with market prices and thereby reduce the incentive for “bad-actors” 
to target Medicare. 

All of these new authorities and analytical tools will help move CMS beyond its 
historical “pay and chase” mode to a prevention-oriented approach with strong fraud 
deterrents and increased enrollment screenings, new disclosure and transparency 
guidelines, and early identification of high-risk providers and suppliers. 

Conclusion 

Health care fraud and improper payments undermine the integrity of Federal health care 
programs. Taxpayer dollars lost to fraud, waste, and abuse harm multiple parties, 
particularly some of our most vulnerable seniors, not just the Federal government. 
Eliminating the problem requires a long-term, sustainable approach that brings together 
beneficiaries, health care providers, the private sector, and Federal, State, and local 
governments and law enforcement agencies, in a collaborative partnership to develop and 
implement long-term solutions. New authorities in the Affordable Care Act offer 
additional front-end protections to keep those who intend to commit fraud out of Federal 
health care programs, as well as new tools for deterring wasteful and fiscally abusive 
practices, and promptly identifying and addressing fraudulent payment issues, which will 
ensure the integrity of Medicare, Medicaid and CHIP. 

This Administration has made a firm commitment to rein in fraud and wasteful spending, 
and with the Affordable Care Act, we have more tools than ever before to implement 
important and strategic changes. CMS thanks the Congress for providing us with these 
new authorities and resources, and looks forward to working with you in the future as we 
continue to make improvements in protecting the integrity of Federal health care 
programs and safeguarding taxpayer resources. 
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Mr. Stearns. Thank you. With that, I will open up with ques- 
tions. Let me start with you, Mr. Spiegel. When I looked at your 
resume, it looks like you have heen on the joh less than a year. You 
started June 2010. So you have really heen the man who is Direc- 
tor of Medicare Program Integrity for less than one year. Is that 
correct? 

Mr. Spiegel. That is correct. 

Mr. Stearns. And you came from the private sector? 

Mr. Spiegel. Most immediately. 

Mr. Stearns. OK. You might not have a handle on this, hut how 
much money, in your opinion, is lost to fraud each year in the 
Medicare program precisely? 

Mr. Spiegel. Well 

Mr. Stearns. Just precisely. 

Mr. Spiegel. I would have to answer that question and say that 
there is no actual one number 

Mr. Stearns. So you don’t know? Is that fair enough? 

Mr. Spiegel. That is correct. 

Mr. Stearns. Now, 60 Minutes in September had an expose on 
Medicare, and they indicated it was $60 billion, and they had one 
witness who indicated it would be $90 billion. Do you think it is 
fair to say that it is anywhere from $60 billion to $90 billion based 
on what 60 Minutes said? 

Mr. Spiegel. Like all of us, I have heard the estimates that have 
come from private groups as well as government 

Mr. Stearns. Why is it so difficult to understand what the figure 
is? If 60 Minutes has come up with it and witnesses have come up 
with it, we had the Justice Department give an estimate, why is 
it that you are the man in charge of Medicare Program Integrity, 
why can’t you give us an estimate of what it is, approximately? 

Mr. Spiegel. Well, because a lot of the estimates that you cite 
and others cite contain information that deals with things that 
aren’t necessarily fraud. Some of them turn out to be improper pay- 
ments, things we want to know about but they are really not fraud 
and it is not necessarily 

Mr. Stearns. All right. Mr. Waxman indicated in his opening 
statement that these new requirements that are in the Obamacare 
prevention will save us $7 billion. Do you think that is an accurate 
statement? 

Mr. Spiegel. I believe Mr. Waxman cited CBO estimates. 

Mr. Stearns. OK. Now, the problem is, it is a $650 billion pro- 
gram and they are saving $7 billion. That is probably about less 
than 1 percent. How can you effectuate eliminating waste, fraud 
and abuse when you cut the program $550 billion like Obamacare 
does? So it is a question for Ms. King. If you are actually cutting 
Medicare program, wouldn’t that make it difficult to prevent waste, 
fraud and abuse just by axiomatic? Wouldn’t it be self evident that 
you can’t cut a program that amount of money and still reduce 
waste, fraud and abuse? 

Ms. King. Mr. Chairman, I think that the reductions in Medicare 
spending are reductions off the rate of growth and not overall re- 
ductions in the size of the 

Mr. Stearns. Well, that is not how we understand it. But Mr. 
Spiegel, let us go to Medicaid. How much is lost to Medicaid, not 
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Medicare, because you say you don’t know. What about Medicaid? 
What is the loss to fraud? 

Mr. Spiegel. Well, it is the same issues that surround trying to 
come up with a number for fraud in Medicare. 

Mr. Stearns. So you have no idea, not even approximate? OK. 

Now, Ms. King, they are expanding Medicaid by another 20 mil- 
lion people they are going to add, and so if you are going to expand 
and increase it, and Medicaid has a lot of fraud, wouldn’t that indi- 
cate that you are going to have increased fraud? 

Ms. King. I think it depends on what happens with the new au- 
thorities that CMS was given in the Affordable Care Act and how 
they are implemented. 

Mr. Stearns. Let me say, the Republicans on this side would be 
very glad to vote for any legislative measure to prevent fraud. Any 
fraud measures, we would be glad to implement. It is just we are 
worried about some of the things I mentioned about. 

So Mr. Spiegel, my concern is, before we expand Medicare and 
Medicaid, we still don’t know how much we lost to fraud and you 
are the man in charge less than a year, so you are saying at this 
point we just have no idea how much it is, how much fraud, waste 
and abuse. So it seems to me that if you don’t even have a handle 
on what the amount is, it is going to be very difficult to penetrate 
it down. 

Let me ask a question to Mr. Roy and Mr. Perez. I appreciate, 
Mr. Perez, I said in my opening statement, I just said that Medi- 
care fraud is rapidly eclipsing the drug trade as far as most profit- 
able and efficient criminal enterprise system. This was comments 
based on the 60 Minutes expose. Do you think that is true? 

Mr. Perez. Well, we certainly have seen some of our investiga- 
tions that individuals that used to participate in the drug trade are 
now certainly involved in health care fraud. 

Mr. Stearns. Have you seen a lot of organized crime involved in 
Medicare and Medicaid fraud, Mr. Roy? 

Mr. Roy. Yes, sir. We are seeing 

Mr. Stearns. Just bring the mic just a little closer to you, if you 
don’t mind. 

Mr. Roy. My apologies. We are seeing an uptick in organized 
crime elements engaging in health care fraud, whether it is in 
structured organizations like Eurasian organized crime that we see 
out in Los Angeles to more loose — knit organizations that we see 
in Texas and the Miami, Florida, area. 

Mr. Stearns. Mr. Roy, this is probably putting you on the spot 
but do you or Mr. Perez and your colleagues, have you come up 
with what is a figure of how much fraud? Would you venture a 
guess? 

Mr. Roy. No, sir, I cannot. 

Mr. Stearns. Would you venture a guess it is more than $7 bil- 
lion a year? 

Mr. Roy. Yes, sir, I would. 

Mr. Stearns. And Mr. Perez, would you venture a guess that the 
fraud in Medicare is more than $7 billion a year? 

Mr. Perez. I know we recovered $3.7 billion, so certainly I 
think 
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Mr. Stearns. So what I am trying to say, Mr. Spiegel, is here 
you have no idea what the fraud figure is and the people to your 
right, one has indicated that he has found just in Florida $3.5 hil- 
lion, so you have — it is just incomprehensible to me how you can 
come here this morning and say you have no idea how much the 
fraud when the man to your right has indicated that he can track 
$3.5 billion himself and so I think when Mr. Waxman mentioned 
$7 billion, that is just the tip of the bucket. That is just the tip, 
and there is so much more there and I think Mr. Roy and Mr. 
Perez have confirmed that. 

My time is expired. I will turn to the ranking member, Ms. 
DeGette. 

Ms. DeGette. Thank you so much, Mr. Chairman. 

Let me follow up on that, Mr. Spiegel, with you. I believe the 
CBO estimated that the provisions of the Affordable Care Act will 
save the taxpayers $7 billion over the next 10 years. Is that cor- 
rect? 

Mr. Spiegel. I believe that is what it says. 

Ms. DeGette. Is that the only money that the Administration in- 
tends to save on fraud in Medicare and Medicaid? 

Mr. Spiegel. No. 

Ms. DeGette. Could you explain, please, why that is not the — 
I don’t want this to be misinterpreted that the Administration, that 
these are the only efforts that are going to be made. What other 
efforts are being undertaken to eliminate fraud, waste and abuse, 
briefly? 

Mr. Spiegel. First of all, however much the number is for fraud 
that is going on is too much. 

Ms. DeGette. Right. What other efforts are being undertaken to 
avoid fraud, waste and abuse, briefly? 

Mr. Spiegel. So we are implementing the new provisions of the 
Affordable Care Act that allow us to do a better job 

Ms. DeGette. OK. What other — Mr. Perez, do you have an an- 
swer? Oh, you are just trying to move the mic. 

Mr. Spiegel. I mean 

Ms. DeGette. What I am saying is, the provisions of the Afford- 
able Care Act are not the only provisions of law that help 

Mr. Spiegel. Right. That is true. 

Ms. DeGette [continuing]. Us to avoid waste, fraud and abuse. 
What other provisions in law that may be separate and apart from 
the $7 billion are going to help us avoid fraud, waste and abuse? 

Mr. Spiegel. OK. So in addition to the things that I was talking 
about with regard to provider screening, we have a whole range of 
activities that we do now and that we are going to do to oversee 
proper payments 

Ms. DeGette. OK. If you can supplement your answer in writ- 
ing, that would be helpful. 

Mr. Spiegel. I would be happy to do so. 

Ms. DeGette. But in essence, what you are saying is, the $7 bil- 
lion is in addition to efforts that are being currently made? 

Mr. Spiegel. That is right. 

Ms. DeGette. Now, Mr. Perez, the efforts that you are under- 
taking, those are being undertaken under current law, right? Be- 
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cause the Affordable Care Act hadn’t been implemented yet, cor- 
rect? 

Mr. Perez. Yes, ma’am. 

Ms. DeGette. ok. Now, Mr. Spiegel, perhaps you can talk about 
the enrollment screening requirements in the Affordable Care Act. 
Will they work to prevent enrollment by fraudulent providers? 

Mr. Spiegel. Yes. 

Ms. DeGette. And how are they different than previous require- 
ments? 

Mr. Spiegel. Well, the new enrollment screening provisions 
allow us to focus on providers based on the risk that they pose, the 
risk of fraud that they pose. We have new and enhanced screening 
that we would be applying to those that pose the greatest risk like 
criminal background checks, database checks, fingerprinting for 
those that are posing the greatest risk. We have new approaches 
to consolidating our data and sharing data across Medicare and 
Medicaid so that both programs have access to information about, 
for example, providers that have been terminated from Medicaid 
that may be terminated from Medicare as well and vice versa. The 
particular provision that — one of the particular provisions in the 
provider screening rule we just published that may have the most 
effect is the Secretary’s authority to impose temporary enrollment 
moratoria when she determines that there is a need to do that to 
combat fraud, waste and abuse. 

Ms. DeGette. Ms. King, do you believe that some of these new 
provisions that we have talked about today will add to our arsenal 
in being able to target waste, fraud and abuse and to eliminate it? 

Ms. King. Yes, we do. We have previously identified several 
areas where increased enforcement and action would be helpful. 
One of those is enrollment. One is them is in prepayment edits. 
One is in postpayment edits, contractor oversight, and the other is, 
the last is a robust process for corrective action, and the Affordable 
Care Act has provisions in several of these areas designed to en- 
hance CMS’s ability, and some of the key ones I think are on the 
enrollment side because preventing fraud is a lot better and easier 
than chasing after it when it has been committed so 

Ms. DeGette. Correct, and these are new tools. 

Ms. King. Yes, they are. 

Ms. DeGette. But would you agree that some of the existing 
tools that CMS has could also be used in a robust way? 

Ms. King. Yes. Congress starting in 1997 in HIPAA created a 
program, a Medicare integrity program that was designed to focus 
on reducing improper payments and fraud and abuse, and that is 
what some of these activities that have been discussed today are 
funded from 

Ms. DeGette. Thank you. 

Ms. King [continuing]. Before the Affordable Care Act. 

Ms. DeGette. I yield back. 

Mr. Stearns. The gentlelady’s time is expired. The gentleman 
from Texas, Mr. Barton, is recognized for 5 minutes. 

Mr. Barton. Well, thank you, Mr. Chairman. 

Let us start off by saying that everybody on the dais here is anti 
fraud and abuse. John Dingell is anti fraud and abuse. Jan 
Schakowsky is anti fraud and abuse. Diana DeGette is anti fraud 
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and abuse. The chairman is anti fraud and abuse. All of our fresh- 
men down here in the front row are anti fraud and abuse on the 
Republican side. Dr. Murphy is anti fraud and abuse. I mean, we 
are all anti fraud and abuse, so this is not a partisan issue. But 
we are very frustrated. I have chaired hearings on this, John Din- 
gell has chaired hearings on this, Diana DeGette has chaired hear- 
ings on this, Waxman has chaired hearings on this. I mean, it is 
so frustrating that we all agree it is a problem, we all want to solve 
the problem, and yet we still don’t even know the scope of the prob- 
lem. 

Now, why is that important? I believe that if you don’t know 
what the problem is, you can’t set goals on how to solve it. So let 
us say it is a 10 percent problem, which would be $80 billion. 
Maybe a reasonable goal then would be to cut that by 25 percent 
in a given year, which would be $16 billion or $20 billion. Maybe 
it is only a $40 billion a year. But if you guys can’t help us deter- 
mine what the problem is, it is hard for us to decide how to set 
goals to solve it. 

So I am going to go through a series of questions here and they 
are kind of sophomore 101 questions, and hopefully you have got 
great answers to every one of them. My first question is — and I am 
going to ask Mr. Perez because you seem to be the guy at the table 
that actually can do something about it, not just study it or what- 
ever but you can actually make things happen. Do you have the 
ability to seize assets of folks that you arrest and accuse of Medi- 
care and Medicaid fraud? 

Mr. Perez. Well, first. Congressman, thank you very much for 
the vote of confidence. I certainly appreciate that. And the depart- 
ment does not have, or OIG does not have seizure authority but we 
do work in tandem with the Federal Bureau of Investigation or 
other entities that do you have the seizure authority. 

Mr. Barton. Does anybody within HHS have the ability to go out 
and actually seize physical assets, seize cash, seize equipment, or 
do you have to go to the FBI to do that? 

Mr. Perez. Currently, we have to use the FBI unless it is a civil 
proceeding. 

Mr. Barton. Would you like to have the authority, if Congress 
gave you the authority to seize assets? 

Mr. Roy. Sir, if I could respond to that? We would be more than 
happy to have that authority, but you have to understand that the 
size of our organization, taking on full seizure authority entails 
taking on a tremendous amount of additional assets to be able to 
seize that and care for that property and then liquidate that prop- 
erty. It is a tremendous undertaking that is probably 

Mr. Barton. Right now I just want to know if you want to have 
the authority. Mr. Perez seems to think he would like it. You seem 
to think it is more trouble than it is worth. 

Mr. Roy. Well, Mr. Perez is in lockstep here. We will take any 
additional authority that comes our way and utilize 

Mr. Barton. I only have another minute and 25 seconds. Are 
there currently under existing programs taxpayer hotlines where 
people can phone in or mail in or Internet in tips on people they 
think are defrauding the government on billing claims? Do you 
have that? 
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Mr. Roy. Yes, sir. OIG has 1-800-HHS-TIPS as our hotline. 

Mr. Barton. What about my friend here, Mr. Spiegel? Do you 
have those hotlines? 

Mr. Spiegel. We do. We have 1-800-Medicare. We have special 
hotlines in south Florida. 

Mr. Barton. Do you pay bonuses or some sort of a cash payment 
if the tip is followed up and actually proves to be correct? 

Mr. Spiegel. We have a set of rules around that, and yes, we 
have. 

Mr. Barton. How often is that used? 

Mr. Spiegel. It depends. Well, there is a number of criteria that 
define it. It hasn’t been used all that often but it has been just re- 
cently actually. 

Mr. Barton. Do you have within your agency the ability to check 
internally for people that are employees that are part of scams in 
terms of credentialing people that shouldn’t be or checking for folks 
that are paying bills that they shouldn’t pay? Is there an internal 
ability to check within the system? 

Mr. Spiegel. There are. There is a number of contracting re- 
quirements in place to make sure that the people who actually 
make decisions on our behalf are following the rules. 

Mr. Barton. My last question. If it is not proprietary, how often 
does that type of investigation actually produce fraudulent activity 
within the system? In other words, 10 percent of the time that you 
check? 

Mr. Spiegel. I don’t know the exact number. I would be glad to 
get back to you with that, though. 

Mr. Barton. OK. Thank you, Mr. Chairman. And I will have 
some questions for the record. 

Mr. Stearns. Thank you, and recognize the chairman emeritus, 
Mr. Dingell from Michigan, for 5 minutes. 

Mr. Dingell. Mr. Chairman, I thank you and commend for this 
hearing. It is a very important matter, and I would note, I was one 
of the people who went with our ve^ fine investigators when they 
were conducting the nine community raids on these malefactors 
that we are discussing today, and I want to commend you down 
there for the work that you are doing on this matter. I also want 
to commend the people from the Inspector General’s Office, from 
the GAO and our friend. Dr. Spiegel. 

I would like to observe one thing very quickly. No environmental 
impact statements are filed by these criminals and they don’t file 
any lOKs or lOQs so we can know what they are up to, and I want 
to say, Mr. Chairman, I commend you for having this hearing be- 
cause moving this process forward is extremely important and 
there is a lot of money in the recent health care reform legislation 
which will make available to us the ability to make significant sav- 
ings. I am not about to criticize our witnesses today or anybody 
else for not having the cost of these things. These criminals don’t 
operate by the clear light of day. 

These questions are to Dr. Spiegel and to Ms. King. Dr. Spiegel 
and Ms. IGng, do you believe that the new tools included in the Af- 
fordable Care Act will help CMS to meet its goal? Yes or no. 

Ms. King. Yes, if they are implemented properly. 

Mr. Spiegel. Yes. 
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Mr. Dingell. Again, if you please, funding for the health care 
fraud and abuse control program includes mandatory and discre- 
tionary funding. It is divided by CMS’s integrity programs and law 
enforcement programs at the Office of the Inspector General and 
DOJ. The President’s 2012 discretionary request is $581 million. If 
this funding is not provided, will CMS be able to hire the personnel 
necessary to implement the antifraud provisions included in the Af- 
fordable Care Act? Yes or no. 

Mr. Spiegel. Until we find out exactly how much would in fact 
be appropriated, we won’t know exactly what we would be able to 
do but we know that are limited in our ability to plan right now. 

Mr. Dingell. If you don’t get the money, you can’t plan and you 
can’t hire 

Mr. Spiegel. And we wouldn’t be able to 

Mr. Dingell [continuing]. People to support the program work? 

Mr. Spiegel. We would have to ratchet back. 

Mr. Dingell. All right. Now, the Affordable Care Act requires 
high-risk providers and suppliers who want to enroll in Medicare, 
Medicaid CHIP to undergo a higher level of screening. This in- 
creases scrutiny will be critical in rooting out fraud, waste and 
abuse in susceptible programs. If the requested discretionary fund- 
ing is not provided, will CMS be able to fully implement and utilize 
enhanced screening? Yes or no. 

Mr. Spiegel. Again, it would depend on the levels of funding 
that ended up 

Mr. Dingell. The simple fact of the matter is, if you don’t get 
that, you aren’t going to be able to move forward. You aren’t going 
to be able to move forward until you know that you are going to 
get it, and until you get it, you aren’t going to be able to do the 
hiring and the other things that are necessary to bring your en- 
forcement program up to date. Isn’t that right? 

Mr. Spiegel. It would have a severe effect on that, yes. 

Mr. Dingell. Very good. Now, again. Dr. Spiegel, the Affordable 
Care Act requires data sharing among federal agencies to monitor 
and assess risk levels in program areas that improve identification 
of fraud. If the requested discretionary funding is not provided, will 
CMS be able to implement full data-sharing technology needed to 
coordinate monitoring and identifying sources of fraud across the 
federal agencies? Yes or no. 

Mr. Spiegel. No. 

Mr. Dingell. Now, again. Doctor, the goal of the antifraud provi- 
sions in the Affordable Care Act is to move CMS away from that 
wonderful practice of “pay and chase” and preventing improper 
payments from happening in the beginning. While some improper 
payments may be due to honest mistakes, many, many criminals 
have made Medicare and Medicaid their targets and also the other 
programs of this character. CMS has already begun testing risk- 
scoring technology to predict and prevent fraud. If the requested 
discretionary funding is not provided, will CMS be able to fully test 
and pursue the technology? Yes or no. 

Mr. Spiegel. No. 

Mr. Dingell. This to Deputy Inspector General Roy. This last 
summer, as I had mentioned, I was fortunate enough to attend a 
ride-along with the Detroit Medicare’s fraud strike force. That is 
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nine communities. And I saw some of the most extraordinary prac- 
tices by the criminals in making money at the expense of Medicare 
that you could ever believe possible. And so as the first Member to 
ever join Medicare strike force on a ride-along, I have enormous re- 
spect for the fine work that the strike forces are doing. They have 
the difficult task of not only rooting out fraud in our health system 
but protecting our neediest populations, the poor, the elderly and 
the sick, from the criminals seeking to make money from the most 
vulnerable. Do you believe that the Medicare strike forces have the 
staffing resources they need to be effective? Yes or no. 

Mr. Roy. Yes, I do. 

Mr. Dingell. You believe they do now? 

Mr. Roy. Sir, right now in the cities we are operating, yes. If we 
want to expand, I will need additional funding. 

Mr. Dingell. So your answer is that they don’t have the re- 
sources and you are hoping to get them. Is that right? 

Mr. Roy. Absolutely. 

Mr. Dingell. Now, do you agree on that, Ms. King? 

Ms. King. I don’t have the basis of evidence to answer that ques- 
tion. 

Mr. Dingell. Any other witness like to make a comment on 
that? Very well. 

This goes to you again. Inspector General Roy. If the requested 
discretionary funding for the health care fraud and abuse control 
program is not provided, will the health care fraud prevention and 
enforcement action team be able to expand the Medicare strike 
force? Yes or no. 

Mr. Roy. No, sir. 

Mr. Dingell. All right. Now, I guess that completes my time and 
I thank you for your kindness and generosity, Mr. Chairman. 

Mr. Stearns. I thank the gentleman. 

Mr. Burgess, the gentleman from Texas, is recognized for 5 min- 
utes. 

Mr. Burgess. Thank you, Mr. Chairman. 

Mr. Spiegel, so I don’t get lost in all the numbers that we are 
hearing this morning, let me walk through some things and you 
tell me if the thinking is generally correct. Now, if I understand 
correctly, the Congressional Budget Office score for the entirety of 
the Patient Protection and Affordable Care Act that the provisions 
in that act would save about $8 billion over the 10-year budgetary 
cycle. Is that correct? 

Mr. Spiegel. That is my understanding. 

Mr. Burgess. And the HHS estimate of the error rate in the pay- 
ments, the payment error rate, is just under 10 percent at 9.4 per- 
cent a year. Is that correct? 

Mr. Spiegel. Yes. 

Mr. Burgess. Now, Medicaid expenditures are going to increase 
of necessity under the Patient Protection and AffordaWe Care Act. 
The number I calculate for that is about $430 billion over 10 years. 
Does that sound about right? 

Mr. Spiegel. I am not an expert on that Medicaid budget. 

Mr. Burgess. Does GAO have an opinion on the amount that we 
are going to spend additionally in Medicaid over the life cycle of the 
10-year budgetary window? 
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Ms. King. I actually don’t have that number off the top, either. 

Mr. Burgess. Well, it is 

Ms. King. But it certainly 

Mr. Burgess [continuing]. A part of the GAO report that we 
have that the cost of Medicaid expansion is estimated to exceed 
$430 billion over the next 10 years. So I am going to assume the 
answer from GAO is yes. 

So just in Medicaid, just in the expansion of the Medicaid system 
that we are doing, we have an error rate that will lose $43 billion 
over the 10-year budgetary cycle but we have safeguards in the act 
that are going to save us $8 billion, so we are not netting out very 
much in that exchange, are we? And that is your division of CMS, 
right? I mean, that is what you are going to fix, right? 

Mr. Spiegel. I am in the Medicare Program Integrity Group, and 
yes, we are focused keenly on preventing fraud, waste and abuse 
in our program. 

Mr. Burgess. But in fact, the numbers just don’t add up. I mean, 
this is going to cost us a tremendous — I am all for the antifraud 
provisions that are in the Patient Protection and Affordable Care 
Act but there is no way in the world they are going to pay for the 
expansion that is occurring even just in the Medicaid part of this, 
let alone other areas. 

In my area in Dallas-Fort Worth, we have got a very aggres- 
sive — Mr. Roy and Mr. Perez, I am basically directing this question 
to you. We have got a very aggressive investigative reporter. She 
is very, very good. Becky Oliver is her name, and you just never 
know when she is going to walk up behind you and put a micro- 
phone 2 centimeters away from your face and ask a very, very 
tough question, and most of those tough questions have to do with 
Medicare and Medicaid fraud, and I referenced some of that in my 
opening statement. It almost seems as if organized crime and orga- 
nizations from outside the continental United States, offshore orga- 
nizations, are getting involved. This business is so lucrative and so 
easy and the risks are so slight that they are really going after this 
money aggressively. And she was the one that pointed out to me 
that there was a Nigerian national who had several home health 
agencies opened under various provider numbers and a single post 
office box. I guess she wants to be cost-effective so she wasn’t 
spending much on overhead, a single post office box, and yet after 
one of our provider numbers was busted, CMS keeps sending pay- 
ments to the same post office box. I mean, you say you are doing 
stuff with the electronics and getting better at this, but oh, my 
God, that is the sort of stuff, the American people look at and they 
just don’t understand. Is there a way to get at that? 

Mr. Roy. Well, first and foremost, that is the scheme, to have 
multiple provider numbers and set those up. 

Mr. Burgess. So you know that, right? 

Mr. Roy. Yes, sir. We are addressing it. In your city of Dallas, 
that is our brand-new strike force city and we are bringing the re- 
sources to there to adopt that model to address this issue. 

Mr. Burgess. I am going to run out of time. I referenced in my 
opening statement about the prosecutorial force. You guys are 
doing the job we asked you to do and we are grateful for that, but 
when you bring these folks to light, are we able to actually get jus- 
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tice on these criminals or do they end up back out on the street 
to sin again? 

Mr. Roy. Now more than ever, I am seeing sentences and people 
go to jail that is more than I have seen before in the past. People 
are being prosecuted. They are going to federal prison for stealing 
from Medicare. 

Mr. Burgess. How comfortable are you with the prosecutorial 
manpower, the strength of the prosecutorial force that is available 
to prosecute this? 

Mr. Roy. Getting better all of the time. In your particular city, 
the resources coming from the Department of Justice are some of 
the best health care fraud prosecutors in our country. 

Mr. Burgess. Well, I appreciate that, and of course, I have had 
several meetings with HHS and the Department of Justice on this 
issue after being asked the tough questions by Becky Oliver, so I 
credit her with having put some pressure on that, but I have to tell 
you, we have got to do a lot more in this. It is going to overwhelm 
the system. 

Thank you, Mr. Chairman. I will yield back. 

Mr. Stearns. I thank the gentleman. 

Ms. Schakowsky from Illinois is recognized for 5 minutes. 

Ms. Schakowsky. Thank you. 

Do you have a strike force in Chicago, Mr. Roy? 

Mr. Roy. Yes, ma’am, we do. 

Ms. Schakowsky. Can I go on a ride-along? 

Mr. Roy. Yes, ma’am, you can. 

Ms. Schakowsky. Thank you. The Affordable Care Act increased 
mandatory funding for the health care fraud and abuse control 
fund by about $350 million, and indexed funding for the health 
care fraud and abuse control fund and the Medicare and Medicaid 
integrity programs to make sure that funds keep up with inflam- 
mation. Overall funding to fight fraud will increase by about $500 
million over the next 5 years. The House Republicans voted to re- 
peal the health care reform bill, and that would cut off the funds 
the law provided for antifraud activities, so I do want to ask you, 
Mr. Roy, could you describe the impact of cutting off this funding 
and what it would do to antifraud initiatives that the Administra- 
tion is implementing under the Affordable Care Act? 

Mr. Roy. Well, right now, as I stated, from the perspective of 
strike force, we were in nine cities. I would ultimately like to ex- 
pand that using data to justify and find our hotspots. I will say 
without additional funding at this point in time, I don’t think I am 
going to be in a position to open up additional strike force loca- 
tions. I need the resources. I need the additional bodies to put in 
fraud hotspots across the country. 

Ms. Schakowsky. Thank you. 

Mr. Spiegel, would you want to answer that? 

Mr. Spiegel. Sure. I mean, we had planned to expand the strike 
force locations from where they were to a total of 20 because they 
are so effective in what they do, and we are obviously not going to 
be able to go there with the adequate resources to do that. 

Ms. Schakowsky. Thank you. 

Ms. King, the Affordable Care Act includes provisions to provide 
more transparency in nursing home ownership and operating struc- 
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tures and to require training, compliance and ethics. Ensuring that 
we have complete and accurate information on ownership allows 
not just more transparency but provides tools to allow regulators 
to hold any wrongdoers accountable. How important is it to have 
this data, in your view, or in GAO’s view? 

Ms. King. I think that we believe it is always important to have 
good data about the people who are participating in the program 
so that you can track what is going on. 

Ms. SCHAKOWSKY. Mr. Roy, you had mentioned the importance in 
your written testimony, I didn’t hear it orally necessarily but of 
whistleblowers in identifying possible wrongdoing. Last month, a 
Florida long-term-care ombudsman asked for information on nurs- 
ing home structure, the same information that will be required in 
the Affordable Care Act, and was subsequently fired by Governor 
Scott. Without getting into the specifics of the case, do we need to 
provide whistleblower protections for long-term-care ombudsmen 
and others who seek information about fraud and abuse? And in 
the nursing home area, do we need to look at special protections 
for long-term-care ombudsmen? 

Mr. Roy. I am certainly in favor of some type of protection for 
all our whistleblowers. I am not familiar too in-depth with the mat- 
ter you are speaking about. 

Ms. SCHAKOWSKY. Mr. Perez, are you, being in Florida now? 

Mr. Perez. No, ma’am. 

Ms. SCHAKOWSKY. And so the protection for whistleblowers, is 
that an important source for you? 

Mr. Roy. It is, specifically with corporate fraud. Whistleblowers 
often file what we refer to as qui tarn lawsuits, which are lawsuits 
on behalf of the Federal Government. They are usually corporate 
insiders with in-depth knowledge of corporate fraud. From a cor- 
porate standpoint, they are essential to our work. 

Ms. SCHAKOWSKY. And do we have those protections in the new 
act? Are we going to do better to make sure we protect those peo- 
ple? 

Mr. Roy. In the new act, I do not — I am not familiar with any- 
thing that would point toward whistleblower protection but I am 
certainly not an expert on everything in that Affordable Care Act. 

Ms. SCHAKOWSKY. OK. Thank you very much. I yield back. 

Mr. Stearns. The gentleman from Nebraska, Mr. Terry, is recog- 
nized for 5 minutes. 

Mr. Terry. Thank you, Mr. Chairman. 

I like the strike force, or HEAT. It seems to be a common theme 
on both sides of the aisle probably because it is positive news of 
success. I am trying to get my arms around what resources CMS 
has right now to fight fraud and abuse. Under the PPACA, I under- 
stand there will be an additional $35 million per year, as Dr. Bur- 
gess said, that won’t even come close to what will fight fraud and 
abuse from the expansion of Medicare, but that is the CBO num- 
ber. I don’t know what the base is right now. What does CMS set 
aside per year for investigating and prosecuting fraud and abuse? 
Do you know that number? 

Mr. Spiegel. I don’t know right offhand but the investigating 
and the prosecuting takes place to my right. 

Mr. Terry. All right. 
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Mr. Spiegel. But the identification and the looking for in dealing 
with the improper payments and fraud at the front end would be 
us, and it is 

Mr. Terry. Will you please provide that number to the com- 
mittee, please? 

Mr. Spiegel. Yes. 

Mr. Terry. And why I wanted that is so I can get a picture of 
what percentage of your budget is being used for policing purposes, 
and then I would like the opportunity to compare that to private 
sector health insurance who seems to be able to do a lot better job 
in weeding out and finding insurance fraud and abuse and what 
they spend in policing. I think that is a good opportunity to figure 
out if you have enough resources or not. Obviously I would say you 
don’t have enough resources. 

Mr. Spiegel. Well, one of the things about the way the private 
sector does things versus the way we do it is, they have dif- 
ferent — 

Mr. Terry. I didn’t ask that, and I only have 2 minutes. 

Mr. Spiegel. Sorry. 

Mr. Terry. But I am curious about it. 

Let me talk to Mr. Roy. With your strike forces and the work 
with Justice in being able to prosecute these, if you had the perfect 
world and Congress came to you and CMS came to you and said 
what do you need to get $50 billion a year recovered, what would 
you need? 

Mr. Roy. It would have to be a joint effort between us and De- 
partment of Justice. I can hire as many agents as possible to ad- 
dress the fraud but I also need prosecutors to prosecute that case. 
The perfect world is that we utilize the models we are using now, 
looking at data to find these hotspots and then have the ability to 
put agents in those particular hotspots and the prosecutors to pros- 
ecute the cases as well. 

Mr. Terry. Would you be able to provide us information if we set 
a goal of $50 billion per year? And by the way, I think it was the 
testimony, I don’t know if it was you or Mr. Perez said you already 
have 300 agents working in HEAT and these strike forces. 

Mr. Roy. That was just the agents — I do not have 300 agents as- 
signed to strike force locations. When we did that operation 2 
weeks ago, I took 300 out of my 420-plus agents and detailed them 
if they weren’t already on the ground to the cities where we had 
strike force operations take place. 

Mr. Terry. Can I assume that not all 420 of your agents are 
dedicated to fighting CMS fraud and abuse? 

Mr. Roy. That is correct, sir. Eighty percent of our time is spent 
in the realm of health care fraud but we over see the 300-plus pro- 
grams of the department, and I am certainly engaged in oversight 
activities, criminal activities in those other departments as well. 

Mr. Terry. Mr. Perez, being on the streets and getting informa- 
tion, it sounds like fighting drug distribution on the streets. What 
do we need in communities and on the streets to be able to obtain 
this? The gentlelady from Illinois mentioned whistleblowers. I 
think that is probably an important part of this. How much of it, 
and how much of it comes from just hearing on the street? 
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Mr. Perez. I unable to quantify exactly how much we get from 
the street but I think one of the things, to underline your question 
or at least answer it, is one of the things that I think we would 
like to see in the field, at least as agents, are two things, one, an 
ability to access the claims data directly, in other words, be able 
to have — sit outside of a business who we believe fits all the mold 
of a fraudulently run company and actually open up a laptop, log 
on and actually to be able to see whether or not a claim is being 
submitted by that company now, whether or not there are any pay- 
ments that are on the payment floor, if they have already sub- 
mitted claims, and we can make phone calls and actually start 
doing the investigation from right outside of the parking lot. That 
would be helpful. 

Mr. Terry. And that is not available to you today? 

Mr. Perez. Not today. 

Mr. Terry. Thank you. 

Mr. Stearns. The gentleman from Texas, Mr. Gonzalez, is recog- 
nized for 5 minutes. 

Mr. Gonzalez. Thank you very much, Mr. Chairman. 

My question will be to Mr. Spiegel and Mr. Roy. I am trying to 
get at percentages of fraud. I know GAO did a study on Medicare 
and CMS estimated that it could be as much as $48 billion in im- 
proper payments. What I don’t follow here is equating fraud, waste 
and abuse with improper payment. 

Mr. Stearns. Does the gentleman have your speaker on? 

Mr. Gonzalez. Thank you very much, Mr. Chairman. 

I do not want to equate fraud, waste and abuse to improper pay- 
ment, which may be a billing error or a good-faith mistake. So can 
you — taking that into consideration, and I think that Dr. Burgess 
asked if it was an accurate — I think he quoted a percentage of 10 
percent of payments on Medicaid can be attributed to fraud, but 
that wouldn’t be accurate. Is that correct? I think it was Mr. Roy 
or Mr. Spiegel may have responded to Dr. Burgess’s question. 

Mr. Spiegel. That is — what you said is accurate. It is not fraud, 
it is improper payments, and it is important to make that distinc- 
tion as we try and calculate what the elusive number is that every- 
body is going after. Some of the numbers tend to have a lot of im- 
proper payments or just billing errors or things that aren’t any- 
thing more than a mistake included in them. They are not fraudu- 
lent. And so we are reluctant to say things like that but the Med- 
icaid number is improper payments. 

Mr. Gonzalez. Mr. Roy, obviously you are not going to go and 
prosecute and seek some sort of legal action against someone who 
made a good-faith mistake, yet that number is going to be taken 
into consideration when we are trying to look at payments, over- 
payments and so on. What I am saying is, it is not all criminal ac- 
tivity so that when you take Jan out there in your car and you are 
making all the big busts, you are not going to be going to providers 
that have simply made a good-faith mistake on a billing statement? 

Mr. Roy. That is correct, sir. In the strike force model for the 
most part, these providers that we are going after are involved in 
almost 100 if not 100 percent fraud. 

Mr. Gonzalez. But you have limited resources, and I understand 
that, and you are going after the true wrongdoers and such, be- 
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cause I think there are some participants out there that make 
good-faith mistakes. I don’t want to make excuses for anybody out 
there that is billing the government again fraudulently and so on 
and no one is for that, and my colleague from Texas, Mr. Barton, 
pointed that out. 

What about the private sector? Let me ask Mr. Roy and even Ms. 
King, has there ever been a comparison — or Mr. Spiegel — as far as 
what is happening when it comes to fraud, waste and abuse with 
the private sector? What is the percentage there that is being suf- 
fered as a result of the same actors or similar actions by individ- 
uals that are defrauding obviously the private sector? Do we have 
numbers there? Is there a percentage that we can estimate, guess- 
timate as to how much is the private sector suffering as a result 
of fraud or criminal activity? 

Ms. King. To my knowledge, there is not a number out there 
about that and one of the difficulties I think on fraud is that you 
don’t know what you don’t know, and part of the reason I think 
that Medicare doesn’t know the number about fraud or we don’t 
know about that, if someone does something fraudulently, for ex- 
ample, they submit a claim on behalf of a beneficiary who is de- 
ceased or they buy a beneficiary’s number and they submit a clean 
claim, that claim is paid and that is not going to show up as fraud 
or improper payments because it slipped through the system, so 
that is part of the difficulty about estimating a number on fraud. 

Mr. Gonzalez. And I appreciate that. Whether it is in the pri- 
vate sector or public sector, you are still faced with the same di- 
lemma, and I think that is important to point out rather than say- 
ing that this is something distinct and unique to Medicaid or to 
Medicare. 

Mr. Roy, I am just curious, and I have got about 32 seconds but 
quickly, what is the State’s obligation when it comes to Medicaid 
fraud? Because we had an incident in Texas — I don’t know if you 
are familiar — that the governor did relieve the doctor that basically 
was managing or the head of looking at the Medicaid contracts 
with providers as well as the attorney that was charged with pros- 
ecuting. Are you familiar with that case? 

Mr. Roy. No, sir. I believe this might be a question that is prob- 
ably better posed to Mr. Spiegel than myself 

Mr. Gonzalez. Mr. Spiegel, what is the role of the State govern- 
ment? 

Mr. Spiegel. Well, the State government has a responsibility to 
have fraud control, a Medicaid fraud control unit, and they do and 
they look at instances where they can take action to both identify 
and prevent fraud. There is data systems in place in most — and 
again, I am not an expert on this but there are data systems in 
place in most all State Medicaid programs that allow a fairly ro- 
bust analysis of things that appear to be aberrant or improper. 
They have 

Mr. Gonzalez. You can complete your answer, Mr. Spiegel. 

Mr. Spiegel. Sorry. That are similar to the way we do things in 
Medicare where they make sure that they are paying for people 
who are properly enrolled in Medicaid in a proper amount for a 
provider that is eligible to provide the service. 
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Mr. Gonzalez. Thank you, Mr. Spiegel. So that is a shared re- 
sponsibility then? 

Mr. Spiegel. Yes. 

Mr. Gonzalez. Thank you. 

Mr. Chairman, thank you for your indulgence. 

Mr. Stearns. Thank you. 

Mr. Gingrey from Georgia is recognized for 5 minutes. 

Mr. Gingrey. Mr. Chairman, thank you. 

I want to go back to Ms. King in a follow-up on the question that 
Mr. Gonzalez from Texas just asked you, because I think it is a 
real important, pertinent question. Ms. IGng, you are director of 
the Health Care Division of GAO and if you don’t have this infor- 
mation here today, you ought to be able to get it for the committee, 
and the question that he asked in regard to comparing the amount 
of waste, fraud and abuse in the private sector versus the govern- 
ment sector, and primarily we are discussing Medicare and Med- 
icaid, I think is of paramount importance and I want, Mr. Chair- 
man, to ask Ms. King, maybe she can answer that right now and 
I will gladly give you the opportunity to do so. 

Ms. King. You know, we would be happy to look into it and see 
if we could get an answer to it, but as a practical matter, we don’t 
have a right of information from the private sector so we would 
have to ask them to provide that information to us as opposed to 
on the government side where we have a right to information. 

Mr. Gingrey. Well, yes, and I appreciate that and certainly I 
think that you ought to use every tool that you do have available 
to get that information because quite honestly, a lot of us feel that 
the big government and the bigger it gets, the more expansive it 
gets, and 15 million additional people on the Medicaid program and 
we have got 47 million now on the Medicare program of aged and 
disabled, and that number is just going to grow as all the Baby 
Boomers are maturing, and, you know, you expand this Obamacare 
program, another entitlement program, in fact. 

Let me ask you a specific question about that. On July 30, 2009, 
President Obama stated that his health plan — that is why I refer 
to it as Obamacare — was funded by eliminating the waste that is 
being paid out of the Medicare trust fund, and then on September 
10, 2009, Speaker Pelosi said that Congress will pay for half of 
Obamacare, $500 billion, by squeezing Medicare and Medicaid to 
wring out the waste, fraud and abuse, and I will ask you, Mr. Spie- 
gel, as well, was cutting $137 billion out of the Medicare Advantage 
program in any way, shape or form cutting out waste, fraud or 
abuse? 

Ms. King. I don’t have the exact numbers off the top of my head 
but we in MedPAC have done work that has shown that payments 
to Medicare Advantage plans are higher than those that are made 
in fee for service. 

Mr. Gingrey. Well, Ms. King we know that. We understand that. 
It is 112 percent. That is not an arguable — the point is, you over- 
paid them. That is not waste, fraud and abuse. It may be waste 
but it is certainly not fraud and abuse. 

Ms. King. It is not fraud and abuse but it could be considered 
waste by some. 

Mr. Gingrey. Mr. Spiegel, any comment on that? 
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Mr. Spiegel. I am just trying to identify and prevent fraud in 
my job. You know, to respond to the questions about 

Mr. Gingrey. You are going too slow for me. I am going to give 
you a pass. 

Let me go to Mr. Perez and Mr. Roy. Can you tell us what you 
are seeing in terms of organized crime involvement in Medicare 
and Medicaid fraud? That poster over there, I keep looking at it. 
It looks like Murderers Row. But you know, what is going on in 
Miami and is organized crime involved heavily in Medicare and 
Medicaid fraud and abuse, and why? 

Mr. Roy. I will answer the first portion of that question about 
the overall scope of organized crime because it is geographical in 
nature. For instance, in the Los Angeles area you are seeing very 
organized criminal structures, in essence Eurasian organized crime 
entities heavily involved in Medicare fraud. They are involved in 
many street-level crimes as well. They are also involved in things 
such as credit card fraud and identity theft but what we are seeing 
is that in order to get to the upper echelons of these organized 
criminal elements, you have to go through health care fraud. That 
is where they make their money and that is different from what 
we would in Texas and in Miami, and with respect to what we see 
in Miami, I will turn that over to ASAC Perez and he will give you 
an idea of what is going on there. 

Mr. Gingrey. Mr. Perez, thank you. 

Mr. Perez. Thank you for the question. A lot of the things that 
we are seeing are a group or groups of individual that have tiers 
underneath them and for all intents and purposes there is even an- 
other subset of cells that work underneath that second tier and one 
cell won’t necessarily know what the other cell is doing but they 
all kind of report to the same few folks in the top. 

Mr. Gingrey. I see my time has expired, Mr. Chairman, and 
thank you, panelists, for your response, and I yield back. 

Mr. Stearns. I thank the gentleman. 

Mr. Scalise, the gentleman is recognized for 5 minutes. 

Mr. Scalise. Thank you, Mr. Chairman. I appreciate the panel- 
ists for coming. 

We are talking about waste, fraud and abuse. I want to first go 
back to something I saw in our State and ask you to comment on 
some of the things that we saw and how it is being dealt with at 
the federal level. In 1996 when I started in our State legislature, 
our governor appointed a 24-year-old to run our health department. 
At the time it was the largest department in State government, 
and there was a lot of waste, fraud and abuse and the governor 
made it a priority. And we talk about zero tolerance against waste, 
fraud and abuse, it is an attitude. It can’t just be rhetoric. It has 
got to be followed by real action. And so the governor set out on 
a mission to root out that waste, fraud and abuse. He appointed, 
as I said, back in 1996 a 24-year-old to run that department and 
to go and seek it out, and in fact, that new head of our department 
was very aggressive. People went to jail. They shut down programs. 
There were Medicare mills, a lot of things that were going on that 
got rooted out. We cut out almost a billion dollars in waste, fraud 
and abuse in our department. I say that to make a point, that per- 
son that 24 years old at the time is now called the Governor Bobby 
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Jindal. He is now the governor of our State, but he was very ag- 
gressive then as the head of our Department of Health and Hos- 
pitals in rooting out that waste, fraud and abuse and he is still ag- 
gressive today. 

I want to know, what coordination do you all have with our gov- 
ernors who are aggressive in rooting out whether you find Medi- 
care fraud or Medicaid fraud, if you are finding Medicare care by 
a provider that is maybe doing business in other States and Med- 
icaid, how do you coordinate those things with the States who are 
specifically dealing with Medicaid because they do have real juris- 
diction there? I will you all kind of down the list. Ms. King. 

Ms. King. There is one provision in the Affordable Care Act that 
gives CMS the authority to revoke Medicare enrollment if Medicaid 
enrollment has been revoked in a State, so if someone is a bad 
actor in Medicaid and they are excluded from Medicaid, Medicare 
can follow the lead on that, and that is a new authority. 

Mr. Spiegel. And that is addressed in our most recently pub- 
lished final rule with the new screening authorities. 

Mr. SCALISE. Do you coordinate with the governors when you do 
find — let’s say you find Medicare fraud or even, you are working on 
Medicaid fraud, are you all coordinating with those governors in 
those States who maybe have some enforcement that they are try- 
ing to do as well? 

Mr. Roy. Sir, from a law enforcement perspective, we are work- 
ing very closely with our Medicaid fraud control units, which obvi- 
ously the governor, that would be their representative from a fraud 
level. We are doing great work there. Over the last 3 years we have 
probably increased our joint cases with the Medicaid fraud control 
units by upwards of 25 percent. 

Mr. ScALiSE. Thanks. And I need to move because we are limited 
on time. I apologize. 

One of the components we really haven’t talked about a lot is the 
waste component of waste, fraud and abuse, and you know, when 
you talk to doctors, and I have talked to a lot of doctors, especially 
over the last few years since I have been in Congress and we have 
been working on ways to actually reform health care as opposed to 
what I think President Obama did, doctors will tell you the biggest 
area of, you can call it waste — I would — the biggest area of work 
that they do that doesn’t really relate to improving patients’ health 
but it is defensive medicine. They run tests that everybody knows 
they don’t have to run but they do it because they are afraid of friv- 
olous lawsuits. In many cases they have had to fight frivolous law- 
suits but it costs them a lot of money so it is just something that 
every doctor will tell you they do. Do you all consider — first of all, 
do you all consider defensive medicine to be part of waste in the 
definition that we are discussing today, Ms. King? Yes or no. 

Ms. King. I don’t know. I don’t honestly know the answer. 

Mr. SCALISE. Have you done any kind of research to know how 
much this does cost? 

Ms. King. Defensive medicine? We have not done any direct 
work on that. 

Mr. SCALISE. Mr. Roy or Mr. Perez? 
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Mr. Roy. I don’t have a direct comment to that but I want to say 
that we are putting people in jail that are committing fraud, not 
necessarily involved in 

Mr. ScALiSE. Mr. Spiegel? 

Mr. Spiegel. I don’t know the answer to that. 

Mr. ScALiSE. I can’t believe that, you know, especially Mr. Spie- 
gel and Ms. King, would say that you don’t know the answer to 
what doctors will tell you is the biggest area of unnecessary spend- 
ing but something they have to do because they will get sued if 
they don’t run the test but they will tell you probably a third of 
those tests are done not because they think it is in the best deci- 
sion for care of the patient but because they are afraid of getting 
frivolous lawsuits, and in fact, the President’s bill does absolutely 
nothing to address that problem, and doctors will tell you that peo- 
ple in the medical profession across the board will tell you that 
topic was completely ignored, the topic that doctors will tell you is 
probably the biggest cause of waste in health care. And so when 
we talk about adding another 20 million onto the Medicaid rolls, 
at least, I would hope you all would go back and look at just how 
much more we are going to waste in making these doctors run 
these tests, because in our bill, in our real reform bill after we have 
done repeal, we are including medical liability reform where you 
get dramatic savings in waste in health care. But I would ask if 
both Ms. King and Mr. Spiegel would go back and include defensive 
medicine and come back to us with some real costs. Will you get 
the committee that information on what you estimate are the costs 
that it adds to the system to have these defensive medicine prac- 
tices that weren’t addressed in the President’s bill? 

Ms. King. We can certainly look into it. I think it is a difficult 
question because what someone considers defensive medicine may 
be, you know, an unnecessary test on someone’s part 

Mr. ScALiSE. But you can estimate the cost of that? 

Ms. King. Well, there is a lot of variability in how physicians 
practice medicine. 

Mr. SCALISE. As there is with anything that you give estimates 
on. 

Mr. Spiegel? 

Mr. Spiegel. I mean, I would say the same thing Ms. King said. 
We could look into it but the definitions of what falls into the cat- 
egory that you are trying to get a handle on vary, depending upon 
to whom you are speaking. 

Mr. SCALISE. Thank you. I yield back. 

Mr. Stearns. The gentleman’s time has expired. 

Mr. Griffith from Virginia is recognized for 5 minutes. 

Mr. Grifeith. Mr. Spiegel, how many claims does CMS get a 
day? Do you know? 

Mr. Spiegel. I don’t. 

Mr. Griffith. But it would be millions, would it not? 

Mr. Spiegel. It would. 

Mr. Griffith. And do you have any idea what percentage of 
them you are able to review before payment is made? 

Mr. Spiegel. Well, we do a substantial amount of review on vir- 
tually all of them before they get paid. 
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Mr. Griffith. And I saw somewhere, I know that there was 
some testimony earlier that there was some indication that we 
didn’t really know what the private sector’s rate was but I had seen 
somewhere or have information that their rate is about 1-1/2 per- 
cent lost to fraud, and I am just wondering if you have seen that, 
A, and B, if you have studied what the private sector is doing to 
eliminate fraud so you could see maybe if there are better ways for 
eliminating or preventing Medicare fraud. 

Mr. Spiegel. Sure. I have seen some numbers for the private sec- 
tor, and we did look into what it is about them that makes them 
different from us in the way they approach this. So in the private 
sector, they have a different approach to how they deal with ap- 
proval of services that we don’t do in Medicare because we are de- 
signed as a program to get beneficiaries needed services and not to 
impose restrictions at the point of service. But private insurance 
can have prior authorization for a whole range of things that we 
don’t, and so they can eliminate things that may have an impact 
on someone’s need for services or at least impose a barrier there 
that we don’t operate that way. 

Mr. Griefith. Since there appears to be some intent to pay for 
all of this new health care by getting rid of this fraud, have you 
all considered going to a preapproval process? 

Mr. Spiegel. Well, we have had discussions about that among 
ourselves but right now it is not consistent with I guess our statu- 
tory authorities to be doing that. 

Mr. Grifeith. And let me switch 

Ms. King. Sir? 

Mr. Grifeith. I am sorry. 

Ms. King. If I might point out something else that is a key dif- 
ference between the private sector and Medicare is that Medicare 
is an “any willing provider” program so the private sector has 
much more ability to restrict the providers who are coming into the 
program than Medicare does. Now, with some of the new authori- 
ties in the ACA, CMS is going to have more authority to take a 
closer look at providers and keep out providers who are not good 
actors. 

Mr. Griefith. Let me claim back my time. Let me ask, switch- 
ing, something that is kind of interesting, it is my understanding 
that the Medicare number, and I don’t care whether it is Ms. King 
or Mr. Spiegel, but the Medicare number is the same as your Social 
Security number. Is that correct? 

Ms. King. That is correct. 

Mr. Griffith. And then if somebody steals your identity, you 
can’t just go out and change your Social Security number. Wouldn’t 
it be a better policy to have each patient have a separate Medicare 
number and then when somebody steals that number the patient 
can get a new number just like you do with your credit card if you 
lose it or it is stolen by somebody? 

Ms. King. Certainly there have been proposals made to that ef- 
fect. 

Mr. Spiegel. And we are doing a substantial amount of work 
right now to eliminate all the compromised numbers that we have 
identified through both providers and suppliers as well as bene- 
ficiaries. 
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Mr. Griffith. Doesn’t that have the impact on the one hand of 
making it very difficult for the patient and then I guess I would 
ask, what is your opinion of that? You said it had been talked 
about but what do you think? Don’t you think that would be a bet- 
ter policy, Ms. King? 

Ms. King. I think it probably would be. There would be a ques- 
tion, I think, in our minds about what it would cost to effect that 
transition and how long that would take and what would be in- 
volved with that because you have every living beneficiary and 
then new beneficiaries as they come on the rolls. 

Mr. Spiegel. And we agree with that. 

Mr. Griffith. New ones would be a lot easier. That wouldn’t 
probably very much at all. 

Ms. &NG. Yes, they would. 

Mr. Griffith. But anyway. All right. I yield back my time, Mr. 
Chairman. 

Mr. Stearns. The gentleman yields back his time. The 
gentlelady, Ms. Myrick, is recognized for 5 minutes. 

Mrs. Myrick. Thank you, Mr. Chairman. Thanks to all of you for 
being here and thank you, you two who do the investigative work 
for what you are doing and the way you are going about it. 

My question I guess is to Mr. Spiegel. I am not real sure. On 
States, is there a requirement that States report fraud to you, to 
CMS? Because I understand that maybe half the States don’t even 
report data. 

Mr. Spiegel. I don’t know what the requirement is for 

Mrs. Myrick. Would you mind finding out and getting back? Be- 
cause I would like to know. 

Mr. Spiegel. Sure. 

Mrs. Myrick. And then the next question is relative to States, 
do they have their counties report? Does it individually vary by 
State to State? In North Carolina, counties are responsible for re- 
porting the fraud to the State. Is that something that happens 
across the country? You know, when you get right down to the local 
level where they have better control on it maybe than the whole 
State does. It is more efficient? 

Mr. Spiegel. I don’t know about the efficiencies, and it would 
really depend on how each State is set up its operational structure. 

Mrs. Myrick. So each State is in control of how they report that? 

Mr. Spiegel. I would think so. 

Mrs. Myrick. But why do some States not report? Do you know? 

Mr. Spiegel. I don’t know the extent to which they don’t. I mean, 
I know we have fraud investigation databases and we collect infor- 
mation from States, and I think we — what I was trying to say be- 
fore is, I didn’t know what the requirement was. I Imow we get re- 
porting from States about the fraud cases that they uncover and 
I am sure they coordinate closely with 

Mrs. Myrick. I would be curious to know. 

And then the second part of that, are there any minimum stand- 
ards that States have to meet relative to, you know, the waste, 
fraud and abuse, whatever you want to call it, to receive their 
FMAP? 

Mr. Spiegel. Well, again, I am not a Medicaid expert but there 
are requirements that States have to meet, you know, to have a 
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proper State plan in place, they have certain administrative re- 
quirements they have to meet. They have to have a single State 
agency with authority. They have to have Medicaid fraud control 
units and things. 

Mrs. Myrick. And is there a follow-up on that to make sure that 
gets done? And I guess that goes back to my first question, do the 
States all report? Anyway, if you don’t know 

Mr. Spiegel. Well, I know there is follow-up on how the States 
organize themselves and there is constant interaction between the 
folks in CMS who oversee Medicaid around that. 

Mrs. Myrick. But all of you pretty much agree that there needs 
to be more of an effort on this relative to dollars that come from 
what you said before to the different people and you have all re- 
sponded that if there were more dollars into the program for what 
you are doing, you would have a better ability to do it, particularly 
with the two in the middle and what you do with the inspection 
work. 

Mr. Spiegel. We have found that for every dollar we are spend- 
ing, we are getting a substantial return on investment, 6.8 percent, 
I believe. 

Mrs. Myrick. But yet in the new health care bill, there is only, 
in my understanding, $350 million in there for any fraud activities, 
which, if that is divided up across all the agencies, you know, it is 
less than one-tenth of 1 percent of what we are spending on the 
health care bill. So it seems like it is a very small amount that is 
being dedicated to what really is getting at the crux of so much of 
the waste that everybody talks about is going to pay for all this. 
It just doesn’t seem to make sense. It seems like there should be 
more effort put into what you are doing from the standpoint that 
you are actually seeing results and you are getting to the bottom 
of the issue. 

Mr. Spiegel. I mean, I guess we would welcome the opportunity 
to have more resources to do more of the things that we have em- 
barked on. 

Mrs. Myrick. But I know Mr. Terry asked a question about actu- 
ally if we could do this what would it take type thing, so you all 
are going to get back to him with that? 

Mr. Spiegel. Yes, ma’am. 

Mrs. Myrick. I appreciate it. No more questions. 

Mr. Stearns. The gentleman, Mr. Murphy from Pennsylvania, is 
recognized for 5 minutes. 

Mr. Murphy. Thank you. 

I want to go over this list here and I wonder if you can tell me 
if you have any idea where these fugitives are. Carlos Benitez, do 
you know where he might be? Do we know what country he is in? 

Mr. Roy. Sir, I may indeed know the general whereabouts of 
some of these individuals but 

Mr. Murphy. Cuba? 

Mr. Roy. Probably not, sir. 

Mr. Murphy. Are any of these folks in Cuba? 

Mr. Roy. Probably not. 

Mr. Murphy. I understand that some of them actually may be. 

Mr. Roy. Sir, I correct myself. There may be several of those that 
are in Cuba, yes. 
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Mr. Murphy. Because my understanding is there may be as 
many as six, and the question is what the Cuban government is in- 
volved in here. According to some reports, “In a discussion with a 
high-level former intelligence official with the Cuban government 
who asked to remain unnamed,” and this is from University of 
Miami report. He states, “There are indeed strong indications that 
the Cuban government is directing some of these Medicare frauds 
as part of a desperate attempt to obtain hard currency.” The source 
notes that the Cuban government is also assisting and directing 
other instances of Medicare fraud providing perpetrators with in- 
formation with which to commit fraud. They go on to say in the in- 
stance where the Cuban government is not directing or facilitating 
the fraud 

Ms. DeGette. Mr. Chairman? 

Mr. Murphy [continuing]. It does provide Cuba as a place for fu- 
gitives to flee. This gives the Castro regime a convenient and care- 
free way to raise hard currency. Are we doing anything about that? 

Mr. Roy. I have actually inquired before about what are the ties 
to Cuba, and nothing has been brought to my attention that would 
substantiate what you are saying. I am more than happy to take 
a name and a number or if you can get me in touch with that indi- 
vidual to follow up on that. 

Mr. Murphy. This was a report 

Ms. DeGette. Mr. Chairman, will the gentleman just yield brief- 
ly? 

Mr. Murphy. Not on my time. 

Ms. DeGette. I would like to make 

Mr. Murphy. I didn’t yield yet, because I really only have a cou- 
ple of minutes 

Mr. Stearns. Does the gentlelady request a personal privilege or 
a point of order? 

Ms. DeGette. I just want to make sure 

Mr. Stearns. Is this a request for a point of order? 

Ms. DeGette. It is a request for a point of order. 

Mr. Stearns. OK. The gentlelady is recognized. 

Ms. DeGette. I just want to make sure, and I know that you are 
not intending to ask Mr. Roy any information that would in any 
way undermine an ongoing investigation. 

Mr. Murphy. Absolutely. 

Ms. DeGette. I just wanted to clarify that. Thank you. 

Mr. Murphy. Absolutely. 

Ms. DeGette. He looked a little uncomfortable when you asked 
that question. 

Mr. Murphy. I am just asking if 

Ms. DeGette. Thank you very much. 

Mr. Murphy. Thank you. I appreciate that. 

This is a report from the University of Miami. I would be glad 
to let you read that. It is just something I wanted to bring atten- 
tion because it does bring to light there has also been concerns 
about how things happen by other countries where they may be 
doing this as part of an organized-crime issue, recognizing the abil- 
ity to have false claims with Medicare actually may be easier, less 
risk and lower penalties than it would be, for example, with co- 
caine trafficking where you have long mandatory sentences. And so 
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I am wondering along these lines if you are also looking to see-I 
mean, I appreciate the work you are doing. This is great. I am glad 
you are pursuing this. The American people appreciate that. As 
Mr. Barton talked before, we are all in favor of this. I just want 
to make sure we are also looking at this as a mechanism to see if 
you think we need more enforcement, do you need more funding, 
do you need more personnel, or do we need stiffer penalties, or all 
of the above? 

Mr. Roy. We need all of the above, sir. 

Mr. Murphy. Do you think the level of penalties is a factor in 
terms of people are willing to risk the risk and consider jail time 
as the price of doing business? 

Mr. Roy. Well, I certainly felt that way probably 5 to 10 years 
ago but in the recent years I have seen across the board sentencing 
guidelines go up and I have seen perpetrators of health care fraud 
go to federal prison for longer periods of time. If I had my way, 
they would go there longer but that is not the perfect world but I 
see a movement toward the punishment fitting the crime, sir. 

Mr. Murphy. Thank you. Anybody else want to comment on that, 
Mr. Perez or Mr. Spiegel? 

What additional tools then do you think that Congress can give 
all of you with regard to helping investigate Medicare and Med- 
icaid fraud and abuse cases? Are there any other tools you want 
from us? 

Mr. Roy. First and foremost, the funding aspect of it. The fund- 
ing has to be continuous. It has to be long term to ensure that I 
can keep bodies on the ground. It can’t be a one shot in the arm 
type of a situation. Our organization is human resource driven, and 
the more agents I have in the field and the more support staff I 
have, the better job I am going to be able to do. 

Mr. Murphy. I appreciate that. Anyone want to comment? Yes, 
Mr. Perez. 

Mr. Perez. Just from an investigative standpoint, and I men- 
tioned this earlier. I apologize if I am repeating myself at least to 
you. But we certainly would like to have real-time data access so 
that we can see the claims as they are hitting them. We currently 
don’t have that. And there is another system that is out there that 
we would also like access to that actually gives us the profile of the 
providers that are in so that we know once they are in, all of the 
makeup of that particular provider and then we can initiate inves- 
tigations. 

Mr. Murphy. Do you have that profile access now or that is 
something you are asking for in addition? 

Mr. Perez. We do not have it now. 

Mr. Murphy. So to be able to get that profile information on the 
providers and the real-time data so you could I guess more or less 
profile as people are submitting claims that there are things that 
appear to not match standard billing procedures with durable med- 
ical equipment or services, that would show up and you could hit 
on that right away, would that help you? 

Mr. Perez. I think that certainly would help us, yes. 

Mr. Murphy. Mr. Spiegel, do you have a comment on that? 

Mr. Spiegel. Sure. And what I would say is, the President’s 
budget has laid out a number of things that we would want to do 
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in 2012, and for now, we need to have a little bit of time to gauge 
the impact of all the things that we started doing in the last year 
to refocus our efforts on the front end and to take prompt action 
on the folks who need to have action taken against them. 

Mr. Murphy. Thank you. I think if any of you had any other de- 
tails of how that work would out to let the committee know. Thank 
you so much. 

Mr. Stearns. The gentleman’s time has expired. The gentleman, 
Mr. Gardner, from Colorado is recognized for 5 minutes. 

Mr. Gardner. Thank you, Mr. Chairman, and thank you to the 
witnesses for being here today. I appreciate your work on some- 
thing that obviously everybody is concerned about. 

In Colorado, we were able to do a couple of things to detect 
fraud, to fight back against those who would abuse the system. We 
passed legislation that would freeze — ^you know, pair up benefits, 
the public pension fund. If it was a public employee that was in- 
volved, it allowed the board to freeze those assets. We also tried 
to pass legislation that said if you were a contractor, a provider 
that had been convicted of fraud elsewhere, that after a certain 
point you were barred from dealing with the State of Colorado and 
so I want to get into that a little bit for a couple of questions. 

Mr. Spiegel, I wanted to follow up on one of your responses to 
Mr. Griffith. I believe Medicare receives about 4.5 million claims a 
day, and you substantially review every single one of those claims? 

Mr. Spiegel. In some way. We verify that the person who sends 
in the bill, for example, is enrolled in Medicare and that the person 
who received the services is an eligible beneficiary. I mean, there 
are automated claims edits that are in place that look at that. 

Mr. Gardner. How many would you say you substantially review 
that you are actually able to really look at? Because that is all 
automated. I mean, what percentage are you able to actually look 
at to detect 

Mr. Spiegel. If what you are talking about is do we take an op- 
portunity to collect medical records and make a judgment about the 
clinical conditions that were present and things like that, I don’t 
know the exact percent. I could get back to you with that. 

Mr. Gardner. That would be great if you would get back to me 
on that. Thank you. 

And then Mr. Spiegel, we have heard that in terms of both dura- 
ble medical equipment and home health, both are highly suscep- 
tible to fraud. What other areas lose a substantial amount to 
fraud? 

Mr. Spiegel. Well, in our recent screening rule, the ones that we 
put in the high-level-risk category were newly enrolling suppliers 
and newly enrolling home health agencies and those individuals or 
entities that hit some of the triggers that we put in the rule. There 
are examples of other provider and supplier types that we have un- 
covered and that the Inspector General’s work has identified that 
maybe not as a class but as individuals have had some problems. 

Mr. Gardner. And I see in your testimony where you talk about 
delivery system reform, you talk about inflated prices that could 
lead to increased fraud but you have only made reforms in, I be- 
lieve it was nine areas. Why did you just add those reforms in nine 
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areas? If you are overpaying somebody, shouldn’t we reform them 
all? 

Mr. Spiegel. The nine areas were in statute. 

Mr. Gardner. So if they are being overpaid and it is causing 
fraud, do you have an ability to add to those nine areas? 

Mr. Spiegel. I don’t know the answer to that. Over time we have 
an opportunity to add to that based on what we learn from our 
work. 

Mr. Gardner. And the President’s budget 2012 said we are going 
to recover about $32 billion in fraud. Is that how much fraud there 
is? What percentage of fraud total are we recovering? 

Mr. Spiegel. Well, as I mentioned before, we don’t know the 
exact number because the estimates that we have all seen contain 
things that are in addition to fraud. They contain improper pay- 
ments, they contain administrative errors, they contain both public 
and private sector estimates. Until we can get to one number that 
identifies fraud, which is in a sense a legal determination, we are 
not going to be able to 

Mr. Gardner. At what point is a provider barred from doing 
business with a Medicare and Medicaid provider? 

Mr. Spiegel. Well, it would depend on the circumstances. 

Mr. Gardner. After one time they have been found fraudulent? 

Mr. Spiegel. Well, it would depend on, you know — we don’t de- 
termine fraud at CMS. That is a law enforcement decision. And if 
somebody has been convicted of fraud, the Inspector General has 
the opportunity to exclude them from the program for a period of 
time. 

Mr. Gardner. So if somebody is convicted of fraud, are they 
automatically barred? 

Mr. Spiegel. Sir, yes, they are. 

Mr. Gardner. And then are States using that then to bar them 
from their Medicaid programs? 

Mr. Spiegel. We are working on that issue right now. I am not 
sure how in depth the State goes with respect to who they exclude 
from their programs. 

Mr. Roy. We have provisions in our recently published rule to 
implement that so that when someone is excluded from Medicare, 
States will be doing the same thing as well as States excluding 
from Medicaid entities or individuals that have been excluded by 
other State Medicaid programs. 

Mr. Gardner. What happens to the money that you are recov- 
ering from fraud? Does that go back into fraud-fighting efforts? 

Mr. Roy. By law, the money that we recover goes right back in 
the Medicare trust fund. 

Mr. Gardner. So it does not go into additional fraud prevention? 

Mr. Roy. No, sir. 

Mr. Gardner. I yield back my time. 

Mr. Stearns. I thank the gentleman, and I thank the first panel 
for their indulgence and forbearance here. 

Ms. DeGette. Mr. Chairman? 

Mr. Stearns. Just let me finish and I will be glad to recognize 
you. 

There was a question, Mr. Spiegel, that was asked of you and 
you did not know the answer concerning the claims per day. I 
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thought I would put in the record that Health and Human Services’ 
Bill Corr testified in front of the Senate Finance Committee in Oc- 
tober 2009 that CMS gets 4.4 million claims a day with a require- 
ment to pay within 14 to 30 days and they are only able to review 
3 percent of the prepayment. 

The gentlelady from 

Ms. DeGette. I would just ask unanimous consent to follow up 
on one question. 

Mr. Stearns. Sure. Go ahead. 

Ms. DeGette. Mr. Perez, someone asked you if you needed more 
powers and you said you would like to be able to access claims data 
directly when you are on these investigations. Do you need — is this 
a matter of more authority to be given to you by Congress or is it 
just the procedures that your office is using? 

Mr. Perez. I believe it may be an internal issue with the depart- 
ment working with CMS and allowing OIG then to have direct ac- 
cess to that. 

Ms. DeGette. If you need more powers, let us know because it 
would seem to us to be good information for you to be able to ac- 
cess. Thank you. 

Mr. Stearns. I thank the gentlelady. We have another member 
who has joined us. The gentleman from California, Mr. Bilbray, is 
recognized for 5 minutes. 

Mr. Bilbray. Thank you. 

Mr. Perez, we were talking about the ability to impound. IRS has 
been given that power to impound so why wouldn’t we — if we are 
as serious about making sure that taxpayer funds are going out in- 
appropriately, wouldn’t we at least give you the authority that we 
give to the people who make sure that revenue comes in to the 
Federal Government appropriately? 

Mr. Roy. If I could, sir? 

Mr. Bilbray. Go ahead. 

Mr. Roy. I am more than willing and happy to look at that par- 
ticular issue in terms of the ability to impound. We do seize bank 
accounts. It is more in the matter of physical assets but I am more 
than willing to take any additional resources that come my way. 

Mr. Bilbray. I am just concerned, because you see the disconnect 
that we take income of the revenue very seriously but traditionally 
we haven’t put as much weight on reviewing and oversight and re- 
capturing of assets coming back. 

Ms. King, I appreciate your kind words about the wrongful pay- 
ment bill. I was one of the authors of that bill, one of the few bipar- 
tisan bills that got passed last year, but I don’t think that weight 
has been traditionally applied and I would like to make sure that 
we do it. 

Speaking of the IRS, the fact is, a lot of these people are engaged 
in fraud and abuse. I have to believe as a former tax consultant 
that once they get in the habit of filling out applications for rev- 
enue from Medicare and Medicaid inappropriately, I have to believe 
there has got to be more opportunity in there to engage the IRS 
to be able to be involved with this. Remember, it wasn’t the FBI 
that got A1 Capone, right? 

Mr. Roy. Sir, you are correct. We work joint cases with IRS/CID 
all the time just for that purpose. 
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Mr. Bilbray. Mr. Spiegel, I have a concern with something you 
said. I know that this is waste, fraud and abuse in here but you 
appear to take wrongful payments as being sort of separate and 
apart from waste, fraud and abuse. 

Mr. Spiegel. Well, from fraud. 

Mr. Bilbray. From fraud? OK. And that is why I want to clarify 
because you will admit the impact to the taxpayer and to the fed- 
eral family is financially the same between wrongful payment and 
fraud. 

Mr. Spiegel. We are against all of us. We are against improper 
payments and fraud and waste and abuse. 

Mr. Bilbray. OK. So the fact is, is that we need to fast-track 
those items and get it there. 

One of the items that has been brought up is the fact of the use 
of false documentation, identify theft. Now, we usually talk about 
identify theft in different fields, and we have gone around with in- 
dividual the use of identify fraud to falsify employment opportuni- 
ties, illegal presence in the country and everything else. But the 
identity fraud issue that we have seen here with your enforcement 
of the ability of somebody to get a driver’s license, get a document 
and use it fraudulently, that has been documented in your enforce- 
ment as a vehicle that organized crime or these bad guys are using 
in implementing their fraud to the health care system. 

Mr. Perez. Certainly, and in Miami I know that in those in- 
stances where we are able to prove that beyond reasonable doubt, 
we certainly are including those in 

Mr. Bilbray. Has Florida implemented the REAL ID bill yet? Do 
you know? 

Mr. Perez. That I do not know, sir. 

Mr. Bilbray. Mr. Chairman, I just think we need to point out 
that that is one bill that we passed how long ago which was basi- 
cally the number one request of the 9/11 Commission, but we still 
have States that are looking at dragging their feet about using bio- 
metrics, and biometrics is one way we could catch these guys. You 
have biometrics through a driver’s license under one name, you do 
the other. Anybody who watches NCIS knows that, you know, we 
have got that computer technology. We have had it in California 
since 1978. That they will get busted coming in, one guy coming 
in as Smith, another guy coming in as Martinez, and we cross-ref- 
erence those biometrics. So I just want to point out that I think 
that the federal bureaucracy needs to be sensitive that the States 
are the people that provide the IDs in lieu of a federal ID, that 
REAL ID is a way we can secure the system without having to 
have a federal ID and make sure — you know, there is one reason 
why we have got to be serious as federal agents to push that the 
States have to do their part down the line. 

And maybe, Mr. Chairman, our committee can recommend to 
Homeland Security that before we send money to States for home- 
land security projects that we require that the first priority that if 
States haven’t implemented REAL ID and secured this identifica- 
tion issue that should be the first project used with federal funds 
on Homeland Security, and with that, I yield back, unless anybody 
has a comment on that. 
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Mr. Stearns. All right. I thank the gentleman. That could he 
your piece of legislation. 

So I want to thank the first panel again. We will move to our 
second panel and ask the Hon. Alex Acosta to come up and Mr. 
Craig H. Smith and Ms. Sara Rosenbaum, and I invite all my 
members to stay for the second panel. 

The Hon. R. Alex Acosta is a native of Miami and the current 
Dean of the College of Law at Florida International University. He 
received his law degree from Harvard. He served as a law clerk to 
Justice Samuel Alito, then a judge on the U.S. Court of Appeals for 
the 3rd Circuit. He has been the longest serving U.S. attorney in 
south Florida since 1970, sitting as a Senate-confirmed United 
States Attorney for the Southern District of Florida. 

Our second panelist is Craig Smith. He is a partner of Hogan 
and Lovells. He rejoined the firm in 2008 after serving as General 
Counsel for the Florida Agency for Health Care Administration. 
While serving as the chief legal officer of one of the Nation’s largest 
Medicaid programs, he coordinated frequently with the federal offi- 
cials at the Centers for Medicare and Medicaid Services and the 
Department of Justice. 

Our third panelist is Sara Rosenbaum, who received her J.D. 
from Boston University Law School. She has played a major role 
in design of national health policy in areas such as Medicare and 
Medicaid, private health insurance and employee health benefits, 
access to health care from medically underserved persons, maternal 
and child health, civil rights in health care and public health. She 
also worked for the White House Domestic Policy Council. 

So I thank all three of you, and we welcome the Hon. Mr. Acosta 
for your opening statement of 5 minutes. Thank you for staying 
with us. 

STATEMENT OF R. ALEX ACOSTA, DEAN, FLORIDA INTER- 
NATIONAL UNIVERSITY COLLEGE OF LAW; CRAIG H. SMITH, 
PARTNER, HOGAN LOVELLS, LLP; AND SARA ROSENBAUM, 
HIRSH PROFESSOR AND CHAIR, DEPARTMENT OF HEALTH 
POLICY, SCHOOL OF PUBLIC HEALTH AND HEALTH SERV- 
ICES, THE GEORGE WASHINGTON UNIVERSITY MEDICAL 
CENTER 


STATEMENT OF R. ALEX ACOSTA 

Mr. Acosta. Thank you, Mr. Chairman, Ranking Member 
DeGette and distinguished members of the committee. I appreciate 
the opportunity to appear before you to discuss waste, fraud and 
abuse in Medicare and Medicaid. As the chairman mentioned 

Mr. Stearns. Let me just swear you in. If you don’t mind, please 
stand and raise your right hand. 

[Witnesses sworn.] 

Mr. Stearns. Sorry. Go ahead. 

Mr. Acosta. As the chairman mentioned, I served as the United 
States Attorney for the Southern District of Florida from 2005 to 
2009. 

Early in my term, I made the prosecution of health care fraud 
a top priority in my district. I organized in 2006 the South Florida 
Health Care Fraud Initiative. As a result, we became home to the 
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first Medicare fraud strike force in the Nation. The results were 
spectacular hut they were also very sad. By 2008, we accounted for 
32 percent of the Nation’s health care fraud prosecutions. 

From fiscal year 2006 through May 2009, we charged more than 
700 individuals responsible for more than $2 billion in fraud. That 
is actual fraud charged in criminal indictments. I have heard this 
morning that figure now stands at 3.5 billion. Put differently, those 
$2 billion, which is sometimes hard to imagine so I put it in per- 
beneficiary terms. That is $1, 900-plus per beneficiary in south Flor- 
ida. 

Numbers alone, though, don’t tell the story. I was very happy to 
hear that some Members are going to do ride-alongs. I wish more 
Members could visit the strike forces. If I was U.S. Attorney and 
if you visited south Florida, I would take you to our facility. There 
we have a wheelchair that we have shown to other interested indi- 
viduals. That wheelchair was billed again and again and again, the 
same wheelchair not used by patients. We call it the million-dollar 
wheelchair because it was billed that many times. We have boxes 
after boxes of evidence. We have pictures of a pharmacy, and that 
pharmacy is billing thousands, perhaps millions of dollars in expen- 
sive brand-name inhalation products. In fact, the pharmacy was a 
broom closet and there was nothing there. 

That level of fraud should absolutely disgust each and every one 
of us. We enjoy one of the world’s best health care systems but we 
often hear of the skyrocketing costs of health care and we worry 
that one day we will not be able to afford quality care. Reducing 
fraud, as you have already mentioned, is, in public parlance, a no- 
brainer. It should be a bipartisan effort. 

Now, let me say I am proud of the work we did in south Florida 
prosecuting fraud but prosecution is not the solution. We need to 
prevent fraud from happening in the first place. Prosecutions have 
limited deterrence. The sentences, while increasing, are not suffi- 
cient. Prosecutions are resource-intensive. Prosecutions rarely re- 
cover taxpayer dollars wrongfully paid out in fraudsters. The 
fraudsters for the most part spend the money or send the money 
overseas. Prevention is the preferred approach. 

Think of this as perhaps, analogize fraud to a busy intersection. 
How do you prevent accidents at a busy intersection? Do you post 
a police officer at that intersection and ticket cars after they com- 
mit accidents or do you put a red light at that intersection and pre- 
vent accidents in the first place? In the same way, we need to pre- 
vent fraud in the first place. Prosecutions are not the solution. 

Now, effective prevention requires a lot more than front-end 
screening. Effective prevention requires continuous and proactive 
efforts to identify and stop fraud as it happens. The gentleman 
from Virginia, Mr. Griffith, mentioned the issue of unique IDs. 
Well, Mr. Chairman, Ranking Member DeGette, I assume both of 
you have credit cards. Imagine if you call — you use that credit card 
and you call American Express and you say I just lost my card and 
they say thank you very much, we can’t issue a new card with a 
new number; when you get fraudulent charges, let us know and 
continue to let us know in the future because we cannot cancel 
your card. How long would American Express stay in business? But 
that is the system that Medicare uses. Your Medicare number is 
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your Social Security number, a number that is easily found and a 
number that can then be used to bill in your name and that num- 
ber cannot be changed. 

Effective predictive modeling is another tool that can assist with 
fraud prevention. An example of how effective this can be comes 
out of south Florida. South Florida in one year was responsible for 
$92 million in Budesonide billings. This is an expensive inhalation 
drug, and inhalation drugs are a large problem in south Florida. 
Well, the Office of Inspector General did a study to look at these 
billings. Seventy-four percent of the beneficiaries for this drug sub- 
mitted claims that exceeded the 90-day coverage maximum. Any 
private insurance company would say if you exceed a coverage 
maximum, we are not going to pay. Sixty-two percent of those that 
allegedly submitted claims for these drugs in fact hadn’t seen a 
prescribing physician in 3 years. Ten doctors in south Florida were 
responsible for more prescriptions for this drug than all the doctors 
in Chicago combined. Chicago is the next highest billing city. 

These are the kinds of issues that predictive modeling can catch. 
These are the kinds of issues that should be caught. Experience 
shows that prepayment prevention computer models that identify 
billing patterns that stop payments when you see spikes like this 
are the preferable approach. Post-payment pay and chase does not 
work. 

Now, I have heard this morning that CMS is moving away from 
pay and chase, and I think that is a wonderful idea. It is an impor- 
tant issue because we need to catch this before it happens. Mter 
the fact my former colleagues and good friends at OIG can pros- 
ecute with DOJ but that is not going to solve the problem. Thank 
you. 

[The prepared statement of Mr. Acosta follows:] 
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Mr. Chairman, Ranking Member DeGette and distinguished Members 
of the Committee: 

I have been asked to provide testimony regarding (i) my efforts, as 
U.S. Attorney, to combat Medicare fraud and (ii) my thoughts, based on 
these experiences, on how we can reduce - and hopefully prevent - fraud in 
the future. I appreciate the opportunity to appear before you to address this 
critical issue. 

I can think of few more pressing issues than that of health care fraud. 
Americans enjoy one of the world’s best health care systems. We hear 
often, however, of the skyrocketing cost of health care and we worry that 
one day we will be unable to afford quality care. Reducing fraud cuts costs 
without impacting quality. Reducing fraud is, in common parlance, “a no- 
brainer.” 

I served as the United States Attorney for the Southern District of 
Florida (“SDFL”) from 2005 to June 2009. Early in my term, I made the 
prosecution of health care fraud a top priority in my District. The results 
were spectacular, yet sad. From FY2006 through May 2009, my District 
charged more than 700 individuals responsible for submitting more than $2 
billion in fraudulent bills to Medicare. Put differently, we prosecuted more 
than $1,900 in Medicare fraud per senior citizen living in South Florida and 
the Treasure Coast.' 

Admittedly, this $1,900 per capita figure both underestimates and 
overestimates the scope of health care fraud. On the one hand, the actual per 
capita figure for South Florida is much higher, as only a small percentage of 
fraudulent billings are identified and prosecuted. On the other hand, this per 
capita fraud figure, when applied nationally, may be lower as South 
Florida’s popularity with Medicare beneficiaries makes it particularly 
vulnerable to fraud. (I reject the loose allegations, which I have sometimes 
heard, that label South Florida a “fraud capital.” Although fraud in South 


' The U.S, Census estimated the South Florida and Treasure Coast population, as of July 1, 2008, to be 
6,114,069. The South Florida Regional Planning Council estimated that 17.2% of this population was 65 
years or older, yielding 1,051,620 senior citizens, or $1903 per capita. The Southern District of Florida 
also includes Okeechobee and Highlands Counties, which are excluded from these figures as they are not 
part of the South Florida / Treasure Coast Population Areas. 


1 
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Florida is high, it is comparable to other major metropolitan areas with 
similar demographics.)^ 

Imagine the impaet of saving even a fraction of $1900 per Medicare 
benefieiary. This would go a long way toward improving Medieare without 
impaeting the quality of eare, and toward improving our budget defieit. 

Despite our sueeess prosecuting Medicare fraud in South Florida, I 
believe that inereased prosecutions are not the answer to redueing Medieare 
waste, fraud and abuse. I want to make clear that I am proud of the work we 
did in South Florida, and want to thank the prosecutors, agents and staff of 
the Southern Distriet of Florida law enforcement ageneies for their 
ineredible efforts to combat Medicare fraud. I want to thank, and to 
eommend, in particular, my successors, my former First Assistant and later 
U.S. Attorney Jeffrey Sloman, and the now U.S. Attorney, Wilfredo Ferrer, 
for continuing and expanding the District’s anti-fraud efforts. Nonetheless, 
proseeutions are not the solution. 

We heed to prevent fraud from happening in the first place. 
Prosecutions have limited deterrence. Prosecutions are resource intensive. 
Prosecutions rarely recover the taxpayer dollars wrongfully paid out to 
fraudsters. Prevention is the preferred approach. Think, if you will, of anti- 
fraud efforts as analogous to efforts to reduce traffic accidents at a busy 
intersection. What is a better way to reduce accidents at this intersetion: to 
spend resources to station a police officer at that busy intersection to ticket 
cars (and prosecute drivers) that cause traffic accidents, or to place a traffic 
light at the intersection to prevent accidents in the first place? 

I urge you to carefully review the various HHS Office of Inspeetor 
General (“HHS-OIG”) recommendations regarding Medicare and Medieaid, 
and to investigate needed reforms to prevent fraud on these important publie 
programs. 


^ Media reports that reference South Florida as having the highest level of fraud overlook a simple fact. 
From 2006 until today, SDFL has prosecuted more cases than any other District in the nation. As a result, 
SDFL identifies and reports more fraud. This does not imply that there is substantially more fraud, any 
more than an increased incidence of speeding tickets implies that more drivers break traffic laws. Rather, 
the higher numbers are explained in part by our increased incidence of enforcement. Reference to pre-2006 
figures supports this, as prior to our 2006 South Florida Health Care Fraud Initiative, reported measures of 
fraud in South Florida were substantially lower. 
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I. 

Early in my tenure as U.S. Attorney, the SDFL chief of economic 
crimes, Eric Bustillo, provided me data regarding the breadth and depth of 
the Medicare fraud problem. Subsequent investigations confirmed the 
concerns that he raised with me. For example: 

• In 2006, HHS-OIG agents conducted site visits of all 1,581 
durable medical suppliers (“DMEs”) registered in South 
Florida. They inspected the DMEs for compliance with five 
standards, including whether they: (i) maintained a physical 
facilility and (ii) were opened and staffed during business 
hours. A total of 491 (31%) failed to maintain a physical 
facility or were not open during reasonable or posted business 
hours. Indeed, instead of medical equipment businesses, agents 
often found empty offices with “for rent” signs, abandoned 
offices with mail stacked outside the door, and sometimes even 
other businesses such as a florist shop, and a real estate 
company. These 491 suppliers billed Medicare approximately 
$237 million ($97 million paid) from January 1 to November 
30, 2006.^ 

• In 2006, eight percent of Medicare beneficiaries with HIV / 

AIDS lived in South Florida. By contrast. South Florida 
providers accounted for 79% of the amount of drugs billed 
nationally by Medicare beneficiaries with HIV / AIDS. With 
respect to non-oral HIV / AIDS related drugs, South Florida 
providers submitted bills of more than $2.2 billion ($568 
million paid), about 22 times the $100 million submitted ($42 
million paid) in the rest of the nation.'* 

• In 2007, about two percent of Medicare beneficiaries lived in 
South Florida. Nonetheless, South Florida accounted for 17% 
of Medicare spending on inhalation drugs. On a per capita 
basis, Medicare spent approximately $4400 per South Florida 


^ See HHS Office of Inspector General, South Florida Suppliers ' Compliance with Medicare Standards: 
Results from Unannounced Visit. 

See HHS Office of Inspector General, Aberrant Billing in South Florida for Beneficiaries with HIV / 
AIDS. 
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beneficiary receiving inhalation drugs compared with a national 

average of $81 5 per beneficiary.^ 

In 2006, in response to Mr. Bustillo’s presentation, I organized the 
South Florida Health Care Fraud Initiative. Our initiative created more than 
a working group; it brought a different approach to health care fraud 
enforcement. First, to augment the cooperation between lawyers and 
investigators, we co-located SDFL prosecutors and federal agents in a fusion 
center modeled after similar arrangements more traditionally, and 
successfully, used in drug and organized crime prosecutions. To make clear 
that the agents and prosecutors must operate as a team, we cross-designated 
agents who held law degrees as Special Assistant United States Attorneys, to 
help with the prosecutions. 

Second, the initiative streamlined criminal health care fraud 
prosecutions. Traditionally, white collar fraud cases rely on historical 
evidence of past billing records. Reconstructing years of records consumes 
time and resources. The South Florida quick-hit squad, and later the Strike 
Force, instead focused on present fraud, limiting criminal charges to the 
more recent fraudulent billings and thus avoiding the need to reconstruct 
years of data. Again, this resembled similar practices traditionally used in 
drug prosecutions: an individual found dealing illegal drugs is typically 
charged with that single, present act, and prosecutors do not spend additional 
resources recreating past history of drug sales absent a compelling reason. 

Third, South Florida became the first District in which prosecutors 
worked with agents to review near real-time data to identify aberrant billing 
patterns. This use of advance data analysis techniques permitted our teams 
to identify and pro-actively investigate individuals while they were still 
engaged in fraudulent billing. Particular credit for these efforts goes to a 
licensed nurse, whom we employed, who reviewed and identified medically 
unrealistic data trends. 

In 2007, our efforts were substantially energized as the Criminal 
Division’s Fraud Section contributed its attorneys, expertise and resources 
through a Health Care Fraud Strike Force. Attorneys from Washington D.C. 
spent weeks co-located in our facilities. They integrated fairly seamlessly 
with SDFL prosecutors and agents, and they deserve credit for working to 


^ See HHS Office of Inspector General^ Aberrant Claim Patters for Inhalation Drugs in South Florida.. 
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avoid the bureaucratic squabbles that often impede these multi-office team 
approaches. South Florida owes much to their expertise, their contributions 
and their teamwork. 

Our efforts resulted in a substantial increase in health care fraud 
prosecutions in South Florida. Indeed by FY 2008, SDFL was prosecuting 
32% (159 of 502) of the nation’s health care fraud matters. 

Health Care Fraud Cases Prosecuted in SDFL 
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The fraudulent Medicare claims associated with these SDFL prosecutions 
are, as I said previously, both spectacular and sad: 

• FY 2005 - data not available 

• FY 2006 -$138,000,000 

• FY 2007 -$638,000,000 

• FY 2008 -$793,448,162 

• FY 2009 -$951,575,41 5 

The Southern District’s efforts continue to this day. In 2008, the 
Southern District of Florida model was used to establish a Health Care Fraud 
Strike force in Los Angeles, and in 2009, a third Strike Force in Houston. 
Strike Forces now exist in Detroit, Brooklyn, Baton Rouge and Tampa as 
well, and the efforts have been elevated within the Justice Department, with 
the May 2009 creation of the HEAT (Health Care Fraud Prevention and 
Enforcement Action Teams). 


5 
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II. 

Increased prosecutions, while commendable and important, are not the 
solution to Medicare fraud, waste and abuse. This may appear to be a 
surprising statement coming from a prosecutor. It is a belief based on my 
experience prosecuting health care fraud. 

First, prosecutions are an insufficient deterrence. In FY 2010, federal 
court judges sentenced 146 defendants to terms of imprisonment averaging 
more than 40 months.^ In the future, the average sentence will likely 
increase as, pursuant to a directive in the Patient Protection and Affordable 
Care Act, the U.S. Sentencing Commission implements a 2 to 4 level 
increase in Federal Sentencing Guidelines for crimes related to a 
government health program.^ For a first time offender (likely a Level 22 
under the Guidelines), these amendments would add 2 levels, resulting in a 
sentence of about 51 months. 

These are serious sentences, yet they pale in comparison to the terms 
of imprisonment given for drug or other serious federal felonies. And, in my 
experience, they provide an insufficient deterrence. A quick thought 
experiment highlights some of the reasons why the deterrence is insufficient. 
Assume for example, that only 1 in 20 health care fraud criminals are 
identified and prosecuted. (Likely, a far lower percentage are prosecuted.) 
Would an individual, otherwise willing to commit crime, be willing to risk a 
five percent chance of a 5 1 month federal term of imprisonment in order to 
make an easy $2 million (the figure most likely associated with a Level 22)? 
Few fraudsters think in such numerical terms, yet scholarship establishes 
that there is a basis to believe that the risk to reward ratio in these 
circumstances provides for insufficient deterrence. 

Second, prosecutions are resource intensive. The Justice 
Department’s prosecutions pay for themselves many times over in dollars 
recovered and fraud prevented. Nonetheless, they are expensive and drain 
prosecutorial and federal investigative resources. Courts and jails cost 
money too, and these expenses too often are ignored when calculating the 
cost of enforcement. Although Congress has appropriately increased 


See http://www.hhs.gOv/news/press/2011pres/01/20110124a.html. 

’ See httn://www.ussc.cov/l..eeal/Amendments/Reader-Friendlv,t201 10119 RFP Amendments.odf at 54 - 
77. 
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funding for prosecutions (a funding increase that is clearly justified), 
prosecutions are not the most cost effective means of reducing fraud. 

Third, prosecutions rarely recover the full taxpayer loss. Fraudsters 
tend to spend the money they illegally gain, or in some circumstances, to 
transfer the money overseas and beyond the reach of U.S. authorities. Even 
the wealthiest fraudsters often appear to have few assets by the time they are 
prosecuted. 

Prevention is thus the preferred approach. 


III. 

The Patient Protection and Affordable Care Act implements both 
enhanced prosecutorial funding and penalties, discussed supra, and 
enhanced oversight and screening measures, including licensure checks, 
background checks and site visits.* These are important new tools, and I was 
gratified to read that the HHS Secretary, on January 31, 2011, announced an 
implementing final rule that would create a more rigorous screening process 
for providers and suppliers enrolling in Medicare and Medicaid.^ 

Effective prevention, however, requires more than mere front-end 
screening. Effective prevention requires continuous and proactive efforts to 
identify and stop fraud as it happens. Businesses do this effectively. Most 
Americans have received calls from credit card companies asking whether a 
particular charge was theirs. Insurance companies do this effectively. Most 
insured Americans have received letters asking for additional information 
regarding a particular claim. Private business can serve as a model for 
Medicare anti-fraud efforts. 

Among the most important changes that Medicare should consider, in 
my opinion, is assigning unique ID numbers to Medicare beneficiaries. 
Presently, a beneficiary’s Medicare number is his or her social security 
number. This makes fraud simple, as anyone with a beneficiary’s social 
security number can submit fraudulent claims in a beneficiary’s name. This 


“ Congressional Research Service, Medicare Provisions in PPACA at 15. 
’ http://wvrw.hhs.gov/news/press/201 lpres/01/201 10124a.html 


7 



109 


also makes stopping fraud difficult, as Medicare cannot cancel a number that 
is being wrongfully used by a third party to commit fraud. 

Business long ago understood the importance of unique ID numbers 
on credit cards. Imagine, for example, if American Express used a social 
security number instead of a unique number. Imagine further that when a 
cardholder called to identify fraudulent billings, American Express 
responded by stating that they could not change the card number, and that 
the card holder should continue to monitor all bills and provide American 
Express notice of future fraud. American Express would likely be out of 
business, yet that is the system used by Medicare today. Biometric IDs, in 
lieu of paper Medicare cards, would be an additional step to ensure that the 
beneficiary is actually the person on whose behalf a claim is filed. 

Effective predictive modeling is another tool that can assist with fraud 
prevention. I understand that Congress, in the Small Business Jobs Act of 
2010, directed the Secretary to use predictive analytic technology to identify 
improper claims and to prevent the payment of these claims. I encourage 
the Secretary to use this authority aggressively. 

The use of brand name inhalation drugs in South Florida shows the 
potential effectiveness of predictive modeling techniques. As U.S. Attorney, 
I prosecuted many cases involving fraudulent billing of inhalation drugs. 
Often, the claims submitted to Medicare were for fraudulent prescriptions 
that were not needed by beneficiaries, and in fact were not even filled. An 
April 2009 HHS-OIG Report revealed the scope of the problem. South 
Florida accounts for 17% of total Medicare reimbursements for inhalation 
drugs, even though South Florida accounts for only two percent of 
beneficiaries. A very high incidence of claims for particularly expensive 
drugs explained this discrepancy. With respect to Budesonide (a steroid 
inhalation drug used to treat respiratory disorder), for example, providers in 
Miami-Dade County billed Medicare $93.9 million ($48.9 million paid). 

The next highest billing county in the nation was Cook County (Chicago) 
with $2.7 million billed and $1.8 million paid.” 

This report made several observations. First, 74.5% of South Florida 
claims for Budesonide exceeded the 90 day maximum coverage quantity. 

See Office of Inspector General, Aberrant Claim Patters for Inhalation Drugs in South Florida. 

' ' See Office of Inspector General, Questionable Billing for Brand-Name Inhalation Drugs in South 
Florida. 
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Other inhalation drugs similarly exceeded the coverage maximum. Second, 
62% of beneficiaries that were supposedly receiving Budesonide treatment 
had not seen a prescribing physician in at least 3 years. Third, 10 South 
Florida physicians were each listed as ordering more than $3.3 million in 
inhalation claims. In others words, each of these 10 physicians was 
responsible for more claims than all the physicians in Chicago combined. 
Such statistics represent “red flags” that would cause any private insurer to 
stop payment and begin an immediate investigation. Medicare should use 
predictive modeling and advanced data analysis to identify and investigate 
such obviously problematic claims pre-payment . Experience shows that pre- 
payment prevention is preferable to post payment pay-and-chase. 


V. 

Mr. Chairman, Ranking Member DeGette and distinguished Members 
of the Committee. I am gratified by your interest in this issue. As a 
prosecutor, I am prepared to answer questions regarding criminal matters. I 
note, as well, that during my term as U.S. Attorney, we brought several civil 
matters as well, including several average weighted price qui tarns, and am 
prepared to address civil matters. As an American citizen, however, I hope 
that your focus remains on prevention. Thank you for your time and your 
leadership. 
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Mr. Stearns. I thank the gentleman. 

Mr. Smith, you are recognized for 5 minutes. 

STATEMENT OF CRAIG H. SMITH 

Mr. Smith. Thank you, Chairman Stearns, Ranking Member 
DeGette and distinguished members of the committee. Thank you 
for inviting me to testify today. 

I do want to say at the outset that I am here in my personal ca- 
pacity and that my views are not necessarily the views of my law 
firm, Hogan Lovells, or any of the firm’s clients. 

I was asked to appear today to share with you my views of ways 
we can detect and prevent Medicare and Medicaid fraud and abuse 
based principally on my time serving as General Counsel of Flor- 
ida’s Medicaid program which as you have heard operates one of 
the Nation’s largest Medicaid programs in this country. 

Now, we have certainly heard this morning about the serious 
problems that have plagued the Medicare and Medicaid programs 
in terms of fraud, waste and abuse. The real concern is that the 
expenditures under both programs as shown by the chart that is 
on the screen before us today are set to significantly increase over 
the next 10 years, and this means that there is an even greater 
number of bad actors who will look for ways to defraud these pro- 
grams. 

In the past 10 to 12 years, Florida officials realized that the rap- 
idly rising costs of the Medicaid program were threatening the 
State’s long-term financial health, and they began focusing on pre- 
payment fraud and abuse prevention. That is going to be a recur- 
rent theme you are going to hear with me as you heard from Mr. 
Acosta and others today. 

Florida officials also began administering the Medicaid program 
more like a private health insurer would do. Medicare, in contrast, 
has for the most part continued along the “pay and chase” ap- 
proach, as we have heard, and that made Medicare an especially 
easier target for fraudsters, especially in south Florida, as com- 
pared to Medicaid. 

The recent sting operation involving 700 federal and State law 
enforcement officials across the country to apprehend 111 sus- 
pected health care fraud criminals was impressive but it shows 
that at a rate of about seven law enforcement officials to every one 
person arrested, the postpayment is inefficient and highly expen- 
sive. 

In the written remarks I submitted to the subcommittee, I of- 
fered several recommendations for preventing fraud and abuse in 
these programs. For purposes of my testimony today, I would like 
to highlight three of those that have been very effective in Florida’s 
Medicaid program. Number one, the first recommendation is that 
the programs need to better control the provider enrollment process 
and provider network process. You heard Ms. King testify this 
morning from the GAO that the Medicare program is an “any will- 
ing provider” program. This is a problem because bad actors should 
not be able to gain access to the program. One of the most egre- 
gious stories involves a Miami man who served 14 years in prison 
for murder and then recently purchased a medical supply business 
for $18,000 and proceeded to bill the Medicare program for over 
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$500,000 in false claims. Now, he was eventually arrested but that 
was only after he was charged with murdering another person and 
dismembering that person. This is the type of person we should not 
have in any of these programs and a better provider screening and 
enrollment process would catch that. 

The other thing I want to highlight about the provider network 
process, going back to this “any willing provider” approach in Medi- 
care is despite some misconceptions, there is no constitutional right 
for anyone to be a Medicare or Medicaid provider. There are enti- 
tlements for the beneficiaries but there is not a constitutional right 
to be a provider in these programs. Florida understands that in its 
Medicaid program and has added “without cause” termination pro- 
visions in its Medicaid provider agreements. These allow the pro- 
gram to very quickly get bad actors out of the program or people 
we don’t need in the program whereas the Medicare program has 
really struggled expelling bad actors. 

The second recommendation I have for the subcommittee is that 
the programs should consider shifting away from fee-for-service re- 
imbursement methodologies that are ripe and very susceptible for 
fraud and abuse and move toward other payment systems includ- 
ing managed care. Risk-based managed care companies have a fi- 
nancial incentive to detect and prevent provider fraud and abuse 
in these programs. They could be a helpful partner to the govern- 
ment in stopping provider fraud and abuse and saving taxpayer 
dollars. 

My third recommendation is that the programs, as Mr. Acosta 
said, should use predictive modeling and other analytical tech- 
nologies. Prepayment predictive modeling has been used to analyze 
health care claims for many years but in the past its effectiveness 
has been hampered by the inability to limit false positives and 
produce focused, actionable results. Well, those technologies have 
significantly improved and so today, just as the credit card indus- 
try is able to send its cardholders an instant text message or alert 
if there is a suspected fraud transaction, the Medicare and Med- 
icaid program ought to be able to do that up front, and as Agent 
Perez testified this morning, it would be great if they could do that 
in real time as the claims are coming in. In 2008, Medicare paid 
home health agencies in south Florida over $550 million just to 
treat patients with diabetes, and that is more than was paid to 
every other locale in the entire country combined. Predictive mod- 
eling can stop that. 

So we have heard that the fraud, waste and abuse program is 
very real and I applaud the committee for having this hearing 
today. If we focus on prepayment for prevention, that is the way 
to best protect taxpayer dollars, and I welcome any questions you 
might have. Thank you. 

[The prepared statement of Mr. Smith follows:] 
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Chairman Stearns, Ranking Member DeGette and Members of the Committee, thank you for 
inviting me to testify today. My oral and written remarks reflect solely my own views and not 
necessarily those of my law firm (Hogan Lovells US LLP), any of our firm’s clients, or the 
Florida Agency for Health Care Administration, the public agency for which I previously served. 

1 was asked to share my views on effective ways to detect and prevent Medicare and Medicaid 
fraud, waste and abuse based principally on my prior experience serving as the General Counsel 
of Florida’s Agency for Health Care Administration, which operates one of the largest Medicaid 
programs in the nation. As you undoubtedly have read or heard. South Florida frequently has 
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been referred to as “Ground Zero” for health care fraud, and therefore enforcement authorities in 
Florida have a lot of experience dealing with this problem. The situation became so dire that the 
2009 Florida Legislature took the virtually unprecedented step of designating Miami-Dade 
County “a healthcare fraud crisis area for purposes of implementing increased scrutiny of home 
health agencies, home medical equipment providers, healthcare clinics, and other healthcare 
providers” to prevent fraud, waste and abuse.' 

It is important to bear in mind that the focus of my remarks is on true fraud and abuse, as 
opposed to overpayments that occur as a result of honest mistakes. The overwhelming majority 
of healthcare providers serving Medicare and Medicaid beneficiaries are dedicated, honest, and 
high-quality caregivers who not only want to play by the rules, but also want enforcement 
authorities to apprehend and sanction those who do not. The best measures strike the proper 
balance between preventing waste, fraud and abuse while avoiding being so draconian and 
burdensome that honest providers and suppliers choose not to participate, thereby creating an 
access problem for program beneficiaries. 

Unfortunately, there are enough criminals focusing their efforts on Medicare and Medicaid to 
create a significant fraud and abuse problem for this nation. The media have reported that the 
mafia and other organized crime rings have been drawn to Medicare fraud and as a result, federal 
investigators have been threatened, witnesses have been found “riddled with bullets, and a 
woman was discovered dead in a pharmacy under investigation, her throat slit with a piece of 
broken toilet seat.”^ Perhaps even more alarming is the fact that some criminals have been 
willing to risk the health and safety of vulnerable Medicare and Medicaid beneficiaries in order 
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to reap their ill-gotten financial gains.^ Every taxpayer dollar wasted through fraud, abuse or 
other improper payments is a dollar that could have been used to provide a needed health care 
item or service to an eligible beneficiary. Accordingly, the Committee is right to focus on efforts 
to prevent Medicare and Medicaid waste, fraud and abuse. 

On February 17, 201 1, federal authorities announced that 1 1 1 doctors, nurses, company owners, 
“patient recruiters” and other individuals nationwide were arrested and charged with conspiring 
to loot more than $225 million from Medicare."' The Department of Justice announced that 
more than 700 federal and state enforcement authorities across the country participated in this 
operation, and arrests were made in Baton Rouge, Brooklyn, Chicago, Dallas, Detroit, Houston, 
Los Angeles, Miami, and Tampa.* While certainly impressive in its size and scope, this 
enforcement operation highlights two very significant points: (1) many corrupt individuals 
continue to view Medicare and Medicaid fraud as a lucrative career path, and (2) at a rate of 
nearly seven enforcement agents needed to apprehend one criminal, the post-payment (i.e., “pay 
and chase”) approach to fraud and abuse detection and prevention is extremely expensive and 
highly inefficient. 

What, then, can be done? In my view, the best techniques are those that prevent improper 
payments in the first place. With a greater emphasis on pre-payment fraud and abuse prevention, 
we can decrease significantly the loss of taxpayer dollars and make healthcare fraud a much less 
desirable career path. The best pre-payment prevention tactics seem to flow from a few guiding 
principles: limit the number of participating providers to those that are necessary to ensure 
access to quality care; trust but verify the claims submitted by participating providers; and expel 
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those providers, owners or other persons in control of provider organizations— and 
beneficiaries — who commit fraud or participate in fraud schemes. To some extent, the Medicare 
and Medicaid programs already do this. But the tactics employed are not always the best, and 
even the best tactics are not always utilized consistently. From experience, I believe the 
following five tactics are proven and effective ways of significantly reducing Medicare and 
Medicaid fraud and abuse that should be considered: 

1. Maintain Better Control of the Provider Network . Despite the misconceptions of some, 
there is no constitutional right to be a Medicare or Medicaid provider. To the contrary, 
provider participation is based on an agreement between the provider and the governmen 
Accordingly, Congress (with respect to Medicare and Medicaid) and state legislatures 
with respect to Medicaid) have the authority to limit their participating provider 
networks — much like commercial insurers and managed care organizations do — based 
not only on the criminal or professional disciplinary records of individuals but also on 
other legitimate factors, including without limitation the need (or lack thereof) for 
additional providers in the relevant geographic market and whether the provider is 
accredited or otherwise has a proven record of providing high-quality care. 

Further, the Florida Medicaid program has chosen to include a “without cause” 
termination provision, as well as “for cause” termination provisions, in its Medicaid 
provider agreements. The “without cause” termination provision gives the Florida 
Medicaid program the ability to control its provider network and to act swiftly without 
the need to undergo lengthy administrative challenges or other litigation while being 
forced to continue paying the provider. In contrast, the Medicare program has not 
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historically exercised as much control over the scope of its provider network, and it has 
experienced difficulty in ousting certain providers it no longer wishes to have in its 
network. For example, when the Office of Inspector General (OIG) of the United States 
Department of Health and Human Services conducted unannounced site visits of 1,581 
durable medical equipment (DME) suppliers in South Florida, the OlG found that 491 
suppliers failed to maintain a physical facility or were not open and staffed during the 
unannounced site visits, which led the Centers for Medicare and Medicaid Services 
(CMS) to revoke all 491 suppliers’ Medicare billing privileges.* Incredibly, Medicare 
hearing officers later reinstated the billing privileges for 91 percent (222 of 243) of those 
suppliers. In 2008, the OIG reported that of the 222 DME suppliers tfiat had their 
Medicare billing privileges reinstated, 1 1 1 subsequently had their privileges revoked 
again; 37 had their billing privileges inactivated; and the U.S. Attorney’s Office indicted 
18 individuals connected to 15 of the 222 reinstated suppliers.’ 

The waste of taxpayer dollars in this story is incredibly frustrating. First, the Medicare 
program failed to prevent individuals perpetrating fraud from obtaining Medicare DME 
supplier privileges and bilking the Medicare program. Second, long after the fraud was 
perpetrated and the taxpayer dollars were wasted, the suppliers’ billing privileges were 
revoked. However, the OIG reported that the Medicare supplier appeals process was so 
flawed that 91 percent of the revoked suppliers were reinstated.* The Justice Department 
ultimately obtained criminal convictions for a small percentage of the individual 
criminals, but the real problem is the significant amount of taxpayer dollars (improper 
Medicare payments, OIG investigation costs. Medicare appeals process costs, and 
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criminal prosecution costs) that was wasted along the way. If the Medicare program had 
exercised more control over its participating provider network, a significant portion of 
this problem could have been prevented before any taxpayer dollars were wasted. 


2. Significantly Improve the Provider and Supplier Enrollment Screening Process . The 
Florida legislature in recent years has made it more difficult for bad actors to become 
enrolled as providers in the Medicaid program. But more can be done at the federal level 
to keep bad actors out of the Medicare program and, through cooperation with the states, 
the Medicaid program as well. The GAO issued a report in July 2008 after it performed 
covert testing to determine weaknesses in the DME supplier enrollment process. 
According to the GAO: 

Investigators easily set up two fictitious DMEPOS [Durable Medical 
Equipment, Prosthetics, Orthotics and Supplies] companies using 
undercover names and bank accounts. GAO’s fictitious companies were 
approved for Medicare billing privileges despite having no clients and no 
inventory. CMS initially denied GAO’s applications in part because of 
this lack of inventory, but undercover GAO investigators fabricated 
contracts with nonexistent wholesale suppliers to convince CMS and its 
contractor, the National Supplier Clearinghouse (NSC), that the companies 
had access to DMEPOS items. ... As a result of such simple methods of 
deception, both fictitious DMEPOS companies obtained Medicare billing 
numbers. . . . However, if real fraudsters had been in charge of the 
fictitious companies, they would have been clear to bill Medicare from the 
Virginia office for potentially millions of dollars worth of nonexistent 
supplies.^ 
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Another outrageous but unfortunately true example of the Medicare program failing to 
protect beneficiaries and taxpayer dollars involves the case of Guillermo Denis Gonzalez. 
According to reports, Mr, Gonzalez served 14 years in prison for murdering a man with a 
silencer-equipped handgun.'® After being released from prison, Mr. Gonzalez in 2006 
purchased a Medicare-certified medical supply business for $1 8,000, and within one year 
he had submitted $586,953 in false claims for supplies never provided to patients." 
Medicare reimbursed Mr. Gonzalez only $31,442 before he was tracked down and 
arrested — but he also was charged again with murder: “this one for allegedly stabbing 
and dismembering an acquaintance during a monetary dispute,”'^ It goes without saying 
that the Medicare program, at a minimum, should be taking a closer look at individuals 
who have a violent criminal past before allowing them to have a controlling interest in a 
Medicare participating provider or supplier business. 

Some county and city officials have adopted ordinances making it tougher for fraudsters 
to obtain occupational licenses and other local approvals that are required as part of the 
enrollment applications with Medicare and Medicaid, That type of local level 
enforcement, together with continuous communication and coordination among federal, 
state and local officials certainly is a good start, but more can be done. Medicare and 
many state Medicaid programs could make more effective use of the electronic data 
systems that have collected and organized otherwise disparate information pertaining the 
criminal records, professional licensure sanctions and discipline, and other concerning 
conduct to prevent bad actors from having any involvement in an approved Medicare or 
Medicaid provider or supplier. 
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3. Continue Shifting Reimbursement Methodoloaies Away from Fee-for-Service . One of 
the reasons that the overwhelming number of fraud and abuse incidents in Florida occurs 
in the Medicare program as opposed to Florida’s Medicaid program is that Florida greatly 
has shifted away from the previous fee-for-service reimbursement system to capitated 
managed care systems. The capitated Medicaid managed care organizations (MCO) that 
contract with the Florida Medicaid program have a significant financial incentive to 
prevent fraud and abuse, and for the most part they are successful. Even if a Medicaid 
provider under contract with the MCO were to commit fraud', the MCO suffers the 
financial hit, not Florida’s Medicaid program. Of course, a shift to managed care 
presents its ow'n unique set of challenges from a fraud and abuse perspective, but there 
are significantly fewer MCOs than providers and suppliers for the government to monitor; 
further, many of the MCOs are operated either by publicly traded companies or by 
companies with sufficient access to capital to be held financially accountable should any 
improper payments occur. 

4. Increase the Role of Physicians in Detecting and Preventing Fraud . Much of the 
intentional Medicare and Medicaid fraud and abuse is perpetrated by providers or 
suppliers — for example, pharmacies, DME suppliers, home health agencies — ^that first 
must rely on a physician’s prescription in order to obtain government reimbursement. 
Although the Medicare and Medicaid programs have enhanced the requirements for such 
ancillary providers and suppliers to demonstrate that the items or services they furnish to 
beneficiaries are done so in connection with a valid physician’s prescription, it remains 
too easy for bad actors to forge documents or otherwise fraudulently misrepresent that a 
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physician ordered the item or service. The GAO previously has recommended that CMS 
require that physicians receive a statement of Medicare home health services 
beneficiaries received based on the corresponding physicians’ certification, which in turn 
the physicians would review to detect any potential misuse of their authorizations. This 
type of simple and relatively inexpensive approach potentially could detect and prevent 
significant fraud and abuse not only in home health but in other provider and supplier 
areas as well; however, the GAO reported last month that CMS has not implemented this 
recommendation.’^ 

5. Use Predictive Modeling and Other Enhanced Technologies . Pre-payment predictive 
modeling has been used to analyze health care claims for some time, but historically its 
effectiveness has been hampered by an inability to limit false positives and produce 
focused, actionable results. In recent years, however, technology in this area has 
improved significantly. Just as the credit card industry is able contemporaneously to 
identify potentially fraudulent transactions and instantly alert cardholders through email 
and text message alerts, the Medicare and Medicaid programs should be able to use these 
technologies — with an appropriately prompt level of clinical confirmation — to detect and 
prevent fraudulent claims for reimbursement on a prepayment basis. 

In conclusion, recent arrests across the nation for alleged Medicare fraud crimes underscore that 
our nation continues to face a significant problem that threatens taxpayer dollars and in some 
cases, the safety of program beneficiaries. Although criminal and administrative enforcement 
actions are an important part of the overall fight against Medicare and Medicaid fraud and abuse, 
the best way to prevent the waste of taxpayer dollars and to assure appropriate is available and 
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accessible for vulnerable populations is to detect and prevent fraud and abuse on a prepayment 
basis. 

* * * 

Thank you Chairman Stearns and Ranking Member DeGette for holding this hearing and 
focusing on these very important issues. Upon request, I very much would look forward to 
working with members of the Subcommittee to develop proactive, innovative, and most 
importantly, effective ways to eliminate waste, fraud and abuse from Medicare and Medicaid. 


' to CS/CS/CS Senate Bill (1986) (2009). 

^ E. Martinez, “Health Care Goodfellas: Mafia Turns to Medicare Fraud,” (Oct. 7, 2009), 
)Utp:/Avvviv'.cbsncV'',s.com/830 1-504083 162-5368496-5()40t{3.hlml (last accessed on Feb. 25, 201 1). 

^ See, e.g. . “Miami Clinic Owner Pleads Guilty to Fraud,” South Florida Business Journal, January 8, 2009 
(reporting that as part of a plea agreement, the owner of two Miami-Dade medical clinics admitted that his “clinic 
employees intentionally manipulated patients’ blood samples so they would appear to need treatment, when in fact, 
they did not.”). 

** §e£ Dept, of Justice Press Release, “Thirty-Two South Florida Residents Charged as Part of Nationwide 
Takedown by Medicare Fraud Strike Force Operations,” (Feb. 17, 201 1), 
htii')://miami.tbi.gov/doiDrcssrci/ni'cssrcl1 l.'mm()2 17n.htm (last accessed on Feb. 26, 2011). 

® See hup://w\vw. vva5hinalonoosi.com/wp-dvn/content/ai-ticle/201 1/02/1 7/'AK201 1021 703492 pf.html (last accessed 
on Feb. 26, 2011). 

® Department of Health and Human Services, Office of the Inspector General, South Florida Durable Medical 
Equipment Suppliers: Results of Appeals, at ii (October 2008). 

’ Id. at ii, iii. 

® The OIG found that “[tjhere are no criteria for hearing officers regarding the types of evidence required to reinstate 
a supplier’s billing privileges. For suppliers that request a hearing, hearing officers generally accept all 
documentation submitted as legitimate, unless they have reason to believe otherwise.” Id. at 10. 

’ United States Government Accountability Office, Medicare: Covert Testing Exposes Weaknesses in the Durable 
Medical Equipment Supplier Screening Process, (July 2008), available at http ;//\vwwv.uao.gov./new.item.s/d08955 .pdf 
(last visited May 20, 2009). 

C. Hiassen, “Medicare corruption gusher worsens,”Miami Herald (Jul. 17, 2010) 
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” GAO High-Risk Series, An Update. GAO-1 1-278 at 157 (Feb. 16, 201 1). 
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Mr. Stearns. Thank you. 

Ms. Rosenbaum, you are welcome for 5 minutes your opening 
statement. 


STATEMENT OF SARA ROSENBAUM 

Ms. Rosenbaum. Thank you, Mr. Chairman, Ranking Member 
DeGette, committee members. 

You have heard so much information this morning that what I 
would like to focus my comments on has to do with a question that 
arose during the question-and-answer period that I think merits a 
closer look, which is the extent to which fraud and abuse are issues 
in private insurance, not only in private insurance but actually 
fraudulent and abusive activities by private insurers. 

One of the great things, in my view, about the Medicare and 
Medicaid programs is that they are public programs and so we are 
able to know a lot as evidenced by the testimony this morning 
about the extent to which fraud, waste and abuse may be hap- 
pening in the programs. They are extensively studied. There are 
many, many reports. You have made many incredibly important in- 
vestments in curbing fraud, waste and abuse in Medicare and Med- 
icaid and those investments have begun to yield real benefits. We 
know very little actually about fraud, waste and abuse in private 
insurance. We do know that since 1995, according to at least some 
studies, 90 percent of health insurers have begun to institute more 
significant antifraud efforts. Clearly, they have concluded that they 
are experiencing some of the very same problems in their payment 
systems that Medicare and Medicaid are experiencing in their pay- 
ment systems. 

I would note that one factor about the Medicare and Medicaid 
programs that may make them slightly more susceptible to fraud 
and waste and something that I think would be very hard to rem- 
edy, even were the entire Medicare and Medicaid system changed, 
is the nature of the beneficiaries. A lot of studies show that fraud 
generally is more concentrated in communities and among popu- 
lations who are extremely poor, extremely disadvantaged and much 
more vulnerable to fraud. Whether they were given public insur- 
ance or a voucher to buy private insurance, in communities with 
high concentrations of poor and vulnerable populations, this is an 
issue and the investment of federal resources and State resources 
in protecting them against fraud is enormous. 

I think there is something else that is worth mentioning, and 
that is when we see fraudulent behavior by the insurance industry 
itself, and there are actually three kinds of fraud behaviors that I 
think are worth thinking about as you contemplate further efforts 
to try and reduce and prevent fraud. The first of course is Medicare 
Advantage marketing abuses. They are extensively documented. A 
simple Google search of Medicare Advantage marketing abuses 
shows thousands of reports. One of the most interesting is a study 
in rural Georgia. A group of public health students, near and dear 
to my heart, since I am a professor of public health, took on as a 
summer project in an effort to try and uncover marketing abuses 
in rural Georgia by Medicare Advantage salesmen going door to 
door. I would note that one of the best Web sites on the problem 
and what can be done about it is found in the Texas Department 
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of Insurance, so this is something the State insurance departments 
are aware of. 

A second kind of abuse is an abuse in which a health insurer ne- 
gotiates deep, deep, deep provider discounts, fails to disclose those 
discounts among its network providers to enrollees who then in- 
stead of paying what they think is a 20 percent coinsurance rate 
are paying coinsurance rates that are in some cases actually even 
more than the fee that was paid to the provider. And a third type 
of abuse, one that was disclosed by Attorney General Cuomo, is the 
abuse that we saw in the Ingenix cases in which out-of-network- 
provider payment standards are manipulated, reduced and enroll- 
ees who thought they had out-of-network coverage are in fact 
gouged and made to pay very high balance bills. 

Now, these issues, I think, are important to focus on as we move 
into a time when tax subsidies are flowing into the purchase of pri- 
vate insurance products and health insurance exchanges and other 
locations, and so my strongest recommendation to the committee 
would be to consider further steps to empower investigation of in- 
surer fraudulent and abusive behavior. Thank you. 

[The prepared statement of Ms. Rosenbaum follows:] 
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Mr, Chairman and Members of the Subcommittee; 

Thank you for this opportunity to testify before you today. As this Committee undertakes the 
important work of assuring the integrity of the nation's largest public health insurance 
programs, I believe that four points are essential to bear in mind: 

First: Health care fraud (which must be distinguished from payment errors) is endemic to 
health insurance and health care generally, and is not confined to public health insurance 
programs. Indeed, the crucial difference between public and private health insurance in this 
regard is the transparency (given their public nature) that Medicare and Medicaid 
administration and oversight activities bring to the problem of preventing, detecting, and 
curbing fraud. 

Second: Health care fraud occurs at all levels of the health care system, including health care 
financing as well as the provision of health care. Corrupt and fraudulent practices can occur not 
only at the health care delivery level but also in the context of the sale of health plans to public 
and private sponsors. 

Third: The problem of fraud Is generally not one that involves beneficiary conduct. Even when 
beneficiaries are involved, their activities are unwitting. Indeed, the biggest issue facing low 
income, disabled, and elderly beneficiaries is their heightened vulnerability to acts of fraud. 

Fourth: Vigilant fraud prevention and oversight of publicly sponsored health insurance is 
essential, regardless of whether the market is Medicare, Medicaid, or state health insurance 
exchanges. In this regard, the Affordable Care Act contains vital tools for combating fraud in all 
three markets. 
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Overview 

Adequate safeguards against health care fraud are essential to the proper functioning of 
any health care system. Despite strong evidence that fraud is system-wide and affects the cost 
of health care in both public and private insurance, national reporting systems on health care 
fraud fail to capture private sector fraud. As a result, current evidence on the scope of health 
care fraud fails to present the full magnitude of the problem because it tends to focus on fraud 
solely involving public health insurance. 

Existing information on health care fraud also tends to conflate evidence of fraud with 
evidence of payment errors. While payment errors in public health insurance programs pose a 
serious problem, the tools for remedying errors differ significantly from those used to address 
fraud. 


As with any very large enterprise, the U.S. healthcare industry is susceptible to fraud 
and abuse in private and public programs alike. Evidence drawn from fraud studies suggests 
that fraud generally tends to disproportionately target vulnerable populations, such as the poor 
and the elderly. Furthermore, public programs operate under strict reporting requirements, 
thereby creating a situation in which the most commonly available information concerns public 
programs such as Medicaid and Medicare. Fraud can be committed by individual consumers 
and patients, but the most serious health care fraud is not the result of small schemes. It flows 
instead from large-scale misconduct by major industry actors, including insurers, health care 
providers, and corporate suppliers. The vast majority of fraud prosecutions emanate from the 
health care industry itself; indeed, a feature of fraud prosecutions involving patients can be the 
exposure of criminal enterprises designed by corrupt health care providers who in turn induce 
patients into participating in fraudulent schemes. 

In 2007, the U.S. spent nearly $2.3 trillion on health care; that year public and private 
insurers processed more than 4 billion health insurance claims.' The National Health Care Anti- 
Fraud Association (NHCAA) has estimated that conservatively, 3% of all health care spending— 
or $68 billion— is lost to health care fraud. Other estimates by government and law 
enforcement agencies place fraud-related losses as high as 10% of annual health care 
expenditures.' At this rate, losses to fraud— over $220 billion in 2007 alone— would be enough 
to generously support coverage for all uninsured Americans. 


“ National Health Care Anti-Fraud Association. The Problem of Health Care Fraud. Consumer Alert. Available at: 
http://www.nhcaa.org/eweb/DvnamicPagG.a.sDX?webcode=anti fraud resource centr&WDScode=TheProblemOfH 
CFraud. Accessed on October 15, 2009. 

' Id. See also Federal Bureau of Investigation, (2008). Financial Crimes Report to the Public. Fiscal Year 2007. 
Available at: httD://www.fbi.gov/Dublic3tion5/fjnancial/fcs reDOrt2007/financial crime 2007.htm 
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Fraud schemes are not specific to any geographic area and are found throughout the 
entire country.^ Certain types of fraudulent activities (e.g,, stealing patient ID numbers and 
falsely billing for care) tend to be more common. There is also evidence that consumers are 
more susceptible to fraud if they are older and/or poor, thus health care fraud, much like 
mortgage fraud, would tend to be more common in poorer communities because of the greater 
vulnerability of their residents.’ 

Certain aspects of health care increase the risk of fraud. Patients' dependence on their 
health care providers may mean that unscrupulous providers can engage in activities that 
patients may not understand or to which they may acquiesce without a full appreciation of the 
consequences, such as having patients sign forms affirming that they in fact received care when 
services were never furnished. The sheer volume of insurance transactions, coupled with their 
complexity, serves to increase system vulnerability to fraud.^ 

Experts in the field of fraud suggest that health care fraud perpetrators consider their 
conduct to be a low-risk crime, with both public and private insurers offering easy targets. 
Insurers' payment operations are geared toward rapidly processing massive amounts of claims, 
with a focus on coding, not fraud.® Moreover, the commercial insurance industry itself is linked 
with fraud. Fraudulent conduct has been discovered in Medicare Advantage marketing 
practices.’ Furthermore, a widely-publicized investigation by then-New York Attorney General 
Andrew Cuomo, found that the industry has (not for the first time) used the complex nature of 
its own business to commit fraud, in this case by systematically underpaying health insurance 
claims, thereby exposing patients (and providers) to sizable unreimbursed costs that should 
have been covered under their plan terms.® 


^ Clarke M, . "The Control of Insurance Fraud: A Comparative View," The British Journal of Criminology, 30(1) 
(Winter 1990), pp.1-33. 

’ Lee J., Soberon-Ferrer H. Consumer vulnerability to fraud: influencing factors. Journal of Consumer Affairs. 
1997:31(l):70-89. 

® Managed Healthcare Executive, (2004). Healthcare fraud and abuse remains a costly challenge. October 1. 
Available at: httD://managedhea!thcareexecutive-modernmedicine.conn/mhe/Analvsis+&+lndlcations/Healthcare- 
fraud-and-abuse-remains-a-costlv-chall/Articie5tandard/Article/detail/lZ7451 . 

’’Id. 

’’ A Google search of "Medicare Advantage marketing fraud" returned more than 87,000 items. See, e.g., Texas 
Department of insurance Medicare Advantage Resource Page, containing extensive information on marketing 
standards as well as tips for consumers when dealing with the sale of both Medicare Advantage and Medicare Part 
D plans, http://www.tdt-state.tx.-us/consumer/hicaD/medicareadvanta.html (Accessed February 28, 2011) Public 
Health Students Help Fight Marketing Fraud in Washington County 

httD://archwavDartnershiD. uga.edu/news/w3shington-health-news/uea-college-of-public-health-students-helD- 
fieht-medicare-fraud-in-washineton-countv/ (Accessed February 28, 2011) (Detailing Medicare Advantage 
marketing fraud in a rural Georgia town); Store Suspends Medicare Advantage Salesman far Fraudulent Tactics 
httD://www. heaithieadersmedia.com/Drint/HEP-248179/State-Suspends-Medicare-Advantaee-Saie5man-for- 
Fraudulent-Tactics (Accessed February 28, 2010) 

® See 1116 of the Assurance of Discontinuance Under Executive Law §63(15) entered into between UnitedHealth 
Group and New York Attorney General at 

http://www.oag.5tate.nv.u5/bureaus/health care/HIT2/pdfs/United%20Health.Ddf . 
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Even as they improve quality and efficiency, electronic data exchange and other 
technological advances can create further fraud exposure. This is because electronic claims 
transactions both increase the volume of claims, and allow large enterprises to use technology 
to engage in fraud while avoiding computerized fraud detection systems.^ 

Numerous government agencies have found that no segment of the health care delivery 
system is immune from fraud, and'° government investigations have uncovered fraud in all 
industry sectors. Indeed, the failure to systematically and routinely measure the scope of 
fraud has been reported to be a characteristic of the insurance industry worldwide. 

Because Medicare and Medicaid are government-sponsored programs, efforts to reduce 
fraud tend to be more publicly visible, particularly since the federal government now issues 
regular reports across all healthcare sectors. But since 1995, 90% of all private insurers have 
launched anti-fraud campaigns.^^ 

How Widespread is Health Care Fraud and What Forms Does it Take? 

Estimates are that 80% of health care fraud is committed by medical providers, 10% by 
consumers, and the balance by others, such as insurers themselves and their employees. “ 
According to the National Health Care Anti-Fraud Association, the majority of healthcare fraud 
is committed by dishonest providers. “ The most common types of provider fraud are: 

• billing for services that were never rendered; billing for more expensive services or 
procedures than were actually provided or performed ("upcoding"); 

• performing medically unnecessary services solely for the purpose of generating 
insurance payments; 

• misrepresenting non-covered treatments as medically necessary; 

• falsifying a patient's diagnosis to justify tests, surgeries or other procedures that aren't 
medically necessary; 


’w. 

Health Care Fraud, (1995). Hearing before the Senate Select Comm. On Aging." 104th Cong.,lst sess. (March 21) 
(prepared statement of FBi Director Louis J. Freeh). 

” GAO, (1992). Health Insurance: Vulnerable Payers Lose Billiansto Fraud and Abuse. (GAO-T-HRD-92-29). May 7. 
Available at http://archive.gao.gov/t2pbat6/146578.pdf 
Clarke, supra note 3. 

Cohen EL, Cesta TG. Evolution of nursing case management in a changing health care system. In: Cohen EL, Cesta 
TG, eds. Nursing case management: from essentials to advanced practice applications^ 4'^ Ed. St. Louis, MO: 
Mosby; 2004:399. 

Coalition Against Insurance Fraud. Go Figure: fraud data. Available at 
www.insurancefraud.org/stats.htm. Accessed on October 19. 2009. 

National Healthcare Anti-Fraud Association, supra note 1. 
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• billing a patient more than the co-pay amount for services that were prepaid; 

• accepting kickbacks for patient referrals; 

• waiving patient co-pays or deductibles; 

• over-billing the insurance carrier or benefit plan;'^ and 

• unbundling, that is, the practice of submitting bilis in a fragmented fashion in order to 
maximize the reimbursement for various tests or procedures that are required to be 
billed together at a reduced cost.*^ 

The Table below presents an illustrative overview of the types of fraudulent conduct 
that have been pursued in court or reported in the press in recent years. These examples have 
been drawn from a systematic search of reported actions using legal search engines, as well as 
a review of legal journal and news articles on health care fraud-related actions. 

The types of fraud recovery actions described in the Table might be pursued privately by 
health insurers as civil fraud cases, while, as noted, state Attorneys General or the United States 
Department of Justice also have wide-ranging powers under state and federal law to pursue 
health care fraud under numerous legal theories. 


Table. Examples of Health Care Fraud across the Health Care Industry: Private Health 
Insurance, Medicare, and Medicaid. 


Private Health Insurance H Medicare EH Medicaid HI 


ACCUSED COMPANY 

INDUSTRY 

TYPE OF FRAUD 

RECOVERY 

(Year) 

UnitedHealth!® ; .. : 

Managed. Care . ’ 

Underpaid : consumers 
jl6%-28%) by 

manipulating database it 
‘used/tb ipay customers: for 
out-of-network services •• ' 

$350 million 
(2008) 

■t 


Federal Bureau of Investigations. Financial Crimes Report to the Public Fiscal Year 2007. Available at: 
http://www.fbi.Bov/publications/financlal/fcs reporl2007/financial crime 2007.htm#health . 

American Medical Association v. United Healthcare Corp., 588 F.Supp.Zd 432 (5.D.N.Y. 2008) 
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ACCUSED COMPANY 

INDUSTRY 

TYPE OF FRAUD 

RECOVERY 

(Year) 

McKesson^ 

Pharmaceutical 

Fraudulently inflated 
prices of approximately 

450 drugs charged to W' 
insurers and consumers 

$350 million^° 
(2009) 

HealthNet^^ 

Managed Care 

ERISA and RICO violations' 
by.underpaying consumers 
in several states ; " 

$215 rnijlion 
(2006)'"'; 


Integriited Health 

Cas System .. 

Medical., identity - J' theft; 
false claims ' 


iiiiiiTin 


.False claims. Kickbacks 

$900 million 
(2003) , 

TAP Pharmaceuticafs?%.?' 

> ' k ' “ ^ 

, ■> 

pharmaceutical . 

False claim's)". Conspiracy, 
kickbacks C 



'Hos'pital 

False claims ■ ^ 



Hospital : f - 

False claims, kickbacks 

$631 million ■' ■ 
(2003) V . . 


Rehabilitative , ,7^7.'. 
Medicine Servif,esi.\,< ■■ 

Falseciaims a-"'.' 

$325 million 
(2004), 


New England Carpenters Health Sene//fs Fund, etol. v. First DatoBonk, Inc. and McKesson Corp., 244 F.R.D. 79 (D. 
Mass. August 27, 2007} 

This settlement is a preliminary court approved settlement entered on March 31, 2009 and the hearing on final 
approval is scheduled for July 23, 2009. Available at; 

http://wvi/Vi/.bloomberg.com/app5/nev^s?pid=newsarchive&sid=aVplVzpSQlNI . 

Wachtel v. Health Net; McCoy v. Health Net; and Scharfman v. Health Net. 239 F.R.D, 81 (D. N.J. December 6, 
2006). 

Ronrad W. A New Ailment: Medical ID Theft, N.Y. Times, June 13. 2009. 

United States v. Tenet Healthcare Carp., C. A. No. 03-206 (C.D. Cal. Jan. 9, 2003}. 

^^United States ex rel. Durand v. TAP Pharmaceuticals, CA No. 00-12618-GAO (filed May 1996 in the E.D. Pa., later 
transferred to D. Mass, settled Sept. 28, 2001). 

United States ex rel. Monahan v. St. Barnabas Health Care System, Inc., C.A. No. 02-S702 {D.N.J. June IS, 2006). 
United States, ex. rel. Alderson, v. Columbia/HCA Carporation, Case No. 99-3290 (RCL), part of Case No. 01-MS- 
50{RCL){D. D.C. 2003). 

United States ex rel. James Devage v. HealthSouth Corporation, et al., Civ, Action No. SA'9B-CA-0372FB (W.D. 
Tex.).; L/n/ted Sfofes ex rel. Manning v. HealthSouth Corporation, (W.D. Tex.); and United States ex rel. Brupbacher 
& Associates and Michael C. Freeman v. Natianal Institutional Pharmacy Services, Inc. (D. N. Mex.) (cases settled 
Dec. 30 2004). 
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ACCUSED COMPANY 

INDUSTRY 

TYPE OF FRAUD 

RECOVERY 

(Year) 

Ciena Healthcare 
Management, inc.“ ,, 

Nursing Home 

'!,*■« i - - 

False claims-. - from 

inadequate - care in 

nutrition and ..hydration;' 
the assessment and 

evaluation-' ofr needs," care, 
planning and nursing 
interventions;.;, medication 
management,'" ‘ fall 
prevention, 'and pressure 
ulcer Vare; including the 
prevention- and treatment 
of wounds.’**^' 

$1.25 million^ 
(2007) / 

. -.I,'' 

United Health Group and 
other insurers^® . ' ,r. 

Insurance 

Fraud,' •misrepresentation, 
/deception,. through .use of 
icoinpahyiQwried. Ingenix 
system to; systematically 
’un'd^alue ; JtS'- payment 
obligations^ for physician 
/services. in or^er to shift 
thd'cqst of-dut-ofmetwork 
coverage from the insurer 
tQ,’;members'%. arid plaii' 

■ sponsor’s- . ; «. 

'Approximately 
$100 million 
(2009) •, ■_ 

Amerigroup^^ ' ‘ 

■; Ihsurance/Maniged, fi 

■■Care '• • i»i', 

/False i claims; involving-:, the 

treatment of pregnant 
iLw'omehand otherpatientS;/ 




False claim?, ^ 

Kickbacks < 

$650 million - 
(2006) ■ 

Serono Group^^ , , 
AstraZenica . ^ 

Pharmaceuticals^'' 

Wyeth“ • ' 

Pharmaceutical , ' 

'■vv- * 

False^ claims,^ Kickbacks. * 

1 

$567 million 
$160 million 

Qui tarn action 
pending 


U.S. ex ret. Denise Hubbard v. Ciena Healthcare Management, et al., CV-03-60175 (E.D. Mich.). 

This case involves fraud against both the Medicare and Medicaid programs. 

The American Medical >A550c/of/on v. United Healthcare Corparation, et al., 2009 U.S. Dist. LEXIS 45610 (S.D.N.Y 
May 7, 2009). 

United States, ex rel. Tyson, etal. v. Amerigroup Illinois, Inc., etai, 2007 WL 781729 (N.D.iH. March 13, 2007). 
State of Nevada ex rel. Steinke v. Merck & Company, Inc., 2006 WL 1506901(0. Nev. May 31, 2006). 

United States ex rel. Driscoll v. Serona Laboratories,, Inc., C.A. No. 00-11680 (0. Mass. August 17, 2000). 
^‘'Alabama V AstraZenica, [reported in) BNA, 18 Health Law Reporter (June 3, 2009). 

United States, ex. Rel. Kieffv Wyeth, C.A. No. 03-12366DPW (D. Mass); USDOJ intervention May 18, 2009, 
[reported in] BNA Health Law Reporter 18:687 (June 3, 2009). 
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ACCUSED COMPANY 

INDUSTRY 

TYPE OF FRAUD 

RECOVERY 

(Year) 

, ‘c ;• 



(2000 & 2009) 

Bnstol-Meyers Squibb, _ 
KV Pharmaceuticals,' yv'. 
Roxane Laboratories, 
Abbott Laboratories, “ ■_.* 
Aventis Phar'maceuticaj,? 
leva Pharmaceuticals, '' 
Schenng Plow/Warrick, 
Forest Laboratories, ' '■ 
Baxter International', Dey ^ 
Pharmaceuticals, Bayer 
Phar'maceuticals ' 

Pharmaceutical 

''' ' .K 

>^T iT 

•«f r * ^ to 

'False Claims ; , 

^ ^ 

5 . .s' «« 

s',' i I’.' 

• .g ^ J: V " ' ' '■ 

Sl23',75 million 
(2009) 

Omnicars 

' ’I . 

Pharmaceutical , '1 . 

..-T 

, Ea‘lse'rcFaii|j’s by -yeplacing 

sbrapiF-tlarie . with ' generic 
•'drugs or, switching 'dosage . 
'strengths; , 

$49,5 million = 
(2006) 

Johns Hopkins ' Bayview. 
Medical Center^® j 

k . \ 'i r * 

Hospital TJ t' 

w ' ^ 

False ' Claims Act (qui 
t a m )2,3.sby su b mitt 1 ng f a Is e 
.claims,; .about , • patients 
; ebnd:itions;: that hadt hot 
.'been': actpally diagnosed, or. 
treate’d . t(j . Medicare, 
Medicaid, and TltlCARE , 

$2.75 million .■ 
(2009) 


Source: legal analysis of reported cases (Summer, 2009). 


Provider Fraud: The Most Common Fraud 


This case review suggests that the most common type of fraud involves systematically 
overcharging both private and public insurers for the cost of items and services for which 
payment is specified either by contract or in law. Thus, for example, many pharmaceutical 
companies have been pursued by Medicaid programs for falling to adhere to federal 
prescription drug rebate requirements, with resulting major overcharges to state agencies. 
(Because the Centers for Medicare and Medicaid Services have not yet reported on cases of 
either improper payment or fraud under the Medicare Part D program,^® it is not possible to 


^^Alabama v Abbott Laboratories, No. CV'-05-219 (Ala. Or., Ct. May 22, 2009), [reported in] BNA Health Law 
Reporter 18; 685 BNA) (June 3, 2009). 

^^L/n/ted States et al., ex ret. Bernard Lisitza v. Omnicare, Inc., 01 C 7433, and United States et al., ex rel. David 
Kammerer v. Omnicare, Inc., 04 C 2074 {N.D. tl.). 

United States, ex rel. Mayer v. Johns Hopkins Bayview Medical Center, D. Md., No. l:07-cv-02011-WDQ,, 
(settlement announced 6/30/09). 

^^GAO, Improper Payments; Progress Made, supra note 18. 
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know the magnitude of such practices under Medicare). Similarly, hospitals have been charged 
with systematically upcoding Medicare claims to falsely elevate the cost of care. These cases 
underscore the fact that these schemes depend on intimate knowledge of the health care 
business, the ability to manipulate complex data, and on having an insider status that comes 
with being a health care provider. “ The insurer fraud cases discussed below appear to be 
similarly dependent on complex knowledge and insider status. 

There are unusual instances in which patients themselves appear to be part of the 
scheme, but by far the more common scenario involves the buying of patient information 
without patient knowledge. For example, on January 24, 2007, in United States v. Ferrer, 
Southern District of Florida, a federal jury convicted a defendant in a case involving the theft 
and transfer of Medicare patient information from the Cleveland Clinic in Weston, Florida. The 
defendant purchased the patient information from a co-defendant, a former Cleveland Clinic 
employee, who pled guilty on January 12, 2007 and testified against the defendant at trial. The 
theft resulted in the submission of more than $7 million in fraudulent Medicare claims, with 
approximately $2.5 million paid to providers and suppliers.” 

Private Flealth Insurer Fraud: An Important Added Dimension 

Some of the most striking examples of fraud are those that involve the private health 
insurance industry itself. In these cases, the deception can involve either overstating the 
insurer's costs in paying claims, or systematically and deceptively under-valuing the amounts 
owed by the insurer to a health care provider under the terms of its contract. The result is to 
shift increased responsibility for the cost of care to the plan member and group sponsor, 
thereby avoiding the insurer's obligations under the terms of its contract: 

• in 2009, UnitedFlealth, a leading insurance company, paid $350 million to settle lawsuits 
brought by the American Medical Association and other physician groups for 
shortchanging consumers and physicians on medical services outside its preferred 
network,''^ Under the United insurers' health plans, members pay a higher premium for 
the right to use out-of-network doctors. In exchange, the insurers promise to cover up 
to 80% of either the doctor's full bill or of the "reasonable and customary" rate, 
depending upon which is cheaper. The Attorney General's investigation found that by 
distorting the "reasonable and customary" rate, the United insurers were able to keep 
their reimbursements artificially low and force patients to absorb a higher share of the 
costs. This intentional manipulation of provider payments resulted in an estimated 10% 
to 28% increase in members' direct financial exposure for the cost of out-of-network 


” Dixon P. The World Privacy Forum Report (2006). Medical Identity Theft: The Information Crime that Con Kill You, 
Spring, p.36. Available at http://www.worldprivacyforum.org/pdf/wpf_medicalidtheft2006.pdf 
http://www.U5doi.eov/opa/pr/2007/April/07 opa 278.html . 

The American Medical Association v. United Healthcare Corporation, et ol., 2009 U.S. Dist. LEXiS 45610 (S.D.N.Y. 
May 7, 2009). 

® Id. 
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• Humana and its affiliated private insurer was found to have intentionally 
misrepresented the size of its hospitals' bills to employer-sponsored plan members, 
thereby causing members to pay amounts for their own care that vastly exceeded the 
20% copays they legally owed. Humana secretly negotiated deep discounts with its own 
member hospitals. As a result, plan members were actually paying the majority of the 
hospital bills they incurred rather than the 20% copay they were promised.'’'’ 

Anti-Fraud Enforcement and Recovery Efforts; Expansion of Fraud Prevention Tools Under the 
Affordable Care Act 

Anti-fraud efforts have met with considerable success. The legislative expansion of anti- 
fraud laws and their active enforcement over the years have led to an increase in convictions 
and recoveries, especially In the case of public health insurance programs, as well as to an 
increase in funding for implementation and creation of anti-fraud programs and task forces. 

Among the most important provisions of the Affordable Care Act aimed at 
strengthening fraud prevention and oversight are the following: 

• The Act gives the HHS Secretary the authority to establish more rigorous enrollment and 
screening processes, such as Implementing different screening procedures for providers 
or suppliers based on the risk of fraud, waste and abuse. The Act also gives the 
Secretary enhanced provider oversight measures, such as pre-payment review following 
enrollment. In addition, the ACA authorizes the Secretary to expand disclosure 
requirements, such as requiring suppliers or providers to disclose any affiliation with a 
provider or supplier that has uncollected debt or that has been subject to a payment 
suspension, exclusion, or revocation or denial of its billing privileges under a federal 
health care program. The Secretary is also empowered to impose enrollment 
moratoriums and to create requirements for compliance programs, such as expanding 
surety bond requirements. 

• The Act provides that only Medicare-enrolled physicians or eligible professionals can 
write a home health or durable medical equipment prescription or referral for a range 
of covered services, and authorizes the HHS Secretary to extend this requirement to 
other Medicare-covered items and services. 

• The Act requires that agents, clearinghouses, or other alternate payees that submit 
claims on behalf of Medicaid health care providers register with state Medicaid agencies 
and the Secretary. 

• The Act creates new civil monetary penalties (CMPs) for certain types of infractions, 
including falsifying information on provider enrollment. It also expands the Inspector 


Humana Inc. v. Forsyth, 525 U.S. 299 (1999); 119 S. Ct. 710; 142 L. Ed. 2d 753. 
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General's authority to exclude from participation in Federal health care programs any 
individual or entity that makes a false statement or misrepresentation on an enrollment 
application. In addition, the Act expressly authorizes the Secretary to suspend payments 
to providers if the Secretary determines, in consultation with OIG, that there is a 
credible allegation of fraud, 

• The Act expands the Inspector General's authority to obtain any information necessary 
from individuals or entities to validate claims for payment under Medicare and 
Medicaid, and for evaluation of program economy, efficiency, or effectiveness. 

• The Act expands the Recovery Audit Contractor (RAC) program to require states to 
contract with one or more RACs to help indentify overpayments and underpayments for 
Medicaid services. 

• The Act requires that overpayments be reported and returned within the latter of 60 
days after identification of overpayment or the date that a corresponding cost report is 
due. If an overpayment is retained after the 60-day deadline it is considered an 
obligation for purposes of the False Claims Act. 

• The Act establishes a specific link between the anti-kickback statute and the False Claims 
Act by providing that a claim submitted for "items or services resulting in a violation" of 
the anti-kickback statute also constitutes a false or fraudulent claim under the False 
Claim Act. 

• The Act clarifies that civil liability may be imposed on parties other than the party that 
actually submitted the claim (e.g., others involved in the underlying arrangement). 

• The Act revises the anti-kickback statute by lowering the intent standard needed to 
prove a violation. The revisions provide that a violation can now be found even if no 
criminal intent to specifically violate the Act is proved and even if there is no proof of 
actual knowledge that the statute prohibited such conduct. 

• The Act amends the federal sentencing guidelines by increasing the level of offense (i.e,, 
the severity of the offense for sentencing purposes) for defendants convicted of federal 
health care offenses involving a government program, including conviction under the 
anti-kickback statute. 

• The Act establishes a self-referral disclosure protocol for providers and suppliers to 
disclose actual or potential violations of the physician self-referral law. 

• The Act amends the False Claims Act to give government more control over whether a 
qui tam complaint can be dismissed based on a "public disclosure" bar. The Act also 
lowers the public disclosure bar by providing that only public disclosures resulting from 
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a federal government source will bar a qui tarn relator's claim, and allows a qui tarn 
relator's allegations to be based on indirect or secondhand information, as long as the 
allegation adds to information already in the public domain. 

• Finally, the Act provides $350 million over 10 years to fight fraud and abuse. 
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Mr. Stearns. Thank you. 

Now I will start with questions. I just note, Ms. Rosenbaum, that 
you had indicated your strong support of the public sector but the 
public sector, Mr. Spiegel could not tell us at all how much fraud 
is in the Medicare system but I can assure you that in the private 
sector they would go out of business if they couldn’t answer that 
question on a continual basis. They would go out of business. 

Mr. Smith has outlined three ways he thinks he can prevent 
waste, fraud and abuse, and of course, the predictive modeling 
using computers was one that you mentioned, Mr. Acosta, too. Do 
you agree or would you add to the three that Mr. Smith mentioned 
I thought were pretty incisive? Are there any other ones you would 
suggest? 

Mr. Acosta. I would agree with that and I also would like to 
support a prior comment made about the importance of data ac- 
cess. One of the ways that we were able to bring as many cases 
as we did in south Florida is, we employed a nurse practitioner 
that had access to not real-time data because we couldn’t obtain 
that but fairly recent data to look for billing spikes, and we did 
that ourselves rather than have the HHS OIG agents defer to 
CMS. That kind of integrated data is very important and I would 
like to support Mr. Perez’s request. 

Mr. Stearns. Mr. Acosta, Mr. Smith, do you think we should 
have Medicare issue something besides a Social Security number so 
that they could actually, when a person calls and said listen, there 
is fraud in my billing here, instead of saying well, just keep alert- 
ing us, do you think we should change that? Because that was not 
one that either one of you suggested and that has been mentioned. 

Mr. Acosta. Well, let me — ^you know, let me apologize because 
I thought I had referenced that. I think it is absolutely critical. As 
U.S. Attorney, we would get calls on a weekly basis from individ- 
uals saying we have two legs yet Medicare is paying for a pros- 
thetic leg. Medicare says they can do nothing about it. 

Mr. Stearns. In the 60 Minutes expose, there is a woman there 
who said for 6 years she called for artificial limbs, artificial legs, 
6 years and Medicare did nothing. 

Mr. Acosta. Mr. Chairman, how long would American Express 
be in business if 

Mr. Stearns. That is what I mean. 

Mr. Acosta [continuing]. When you would call and say I lost my 
card, they say we can’t help you. 

Mr. Stearns. Are either one of you concerned that here we are 
expanding the Medicaid program by 20 million people under 
Obamacare and federal spending on Medicare and Medicaid will 
rise from $900 billion in 2010 to almost $2 trillion in 2019? Are you 
concerned that, you know, unless we implement these things that 
obviously we are going to have more fraud? 

Mr. Acosta. From my perspective, I think, you know, it is crit- 
ical that Medicare and Medicaid spend money to modernize their 
system. That involves unique IDs, not the Social Security number. 
That involves predictive modeling. Again, credit cards, if your 
spending patterns deviate at all, they call you up. Why can Medi- 
care not do the same thing? 
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Mr. Stearns. Are you familiar with what the Medicare preven- 
tion fraud in the ACA does? Are either one of you, Mr. Smith or 
Mr. Acosta? Do you think they would help pay for the cost of this 
Medicare expansion and Medicaid expansion just based upon what 
you see in the bill, or do you know what is in the bill? 

Mr. Smith. I certainly am aware of some of the provisions in the 
bill. I think one of the big concerns is we heard testimony today 
from the OIG saying that the current problem, current Medicaid 
and Medicaid fraud problem with the current population of bene- 
ficiaries we have exceeds, in his estimate, $7 billion. So even if you 
took the CBO’s suggestions that the additional funding in the fed- 
eral health reform legislation could help save $6 billion or $7 bil- 
lion, that is barely enough to get close to the estimates of what the 
OIG says is the problem today. 

Mr. Stearns. Excellent point. 

Mr. Acosta, anything you would like to add? 

Mr. Acosta. Yes. I would add to that that most of the — I assume 
you are referring to the ACA, most of the ACA focuses on screening 
measures, licensure checks, background checks, site visits, which 
are important. But, you know, it is not enough. You need to actu- 
ally review claims as they come in using predictive modeling. You 
need to have prepayment screening of claims. 

Mr. Smith. And Chairman, I would echo that and say that that 
is why I really think it is important as part of the Small Business 
Jobs Act, that is where the predictive modeling legislation was 
added. It is not part of the original federal health reform legislation 
and so I think that predictive modeling and analytical tech- 
nology — 

Mr. Stearns. It is hard to believe. So the predictive modeling 
using computers is not part of the prevention program in 
Obamacare right now. Is that the way you understand it? 

Mr. Smith. Well, I think that the federal health reform legisla- 
tion does ask and does provide for additional technologies to be 
used but the predictive modeling piece and the key piece for pre- 
payment — 

Mr. Stearns. Is not there. I am just going to close by asking you 
quickly, in your opinion, do you think organized-crime involvement 
in Medicare and Medicaid has been, you know, pretty prevalent in 
south Florida? Have you seen a lot of organized-crime figures en- 
gage in Medicare fraud? 

Mr. Acosta. I certainly have. If I could just clarify a small point. 
The Small Business Jobs Act of 2010 did have authorization for 
predictive modeling. HHS is looking at this. But the authorization 
was put in a separate provision. 

With respect to organized crime, I think it is a clear method by 
which organized crime makes money. It is highly profitable. We are 
talking not millions but billions of dollars, $2 billion in actual 
charged criminal indictments. That is not all of it that is on the 
street. That is simply what we proved in court in south Florida 
alone. One of the frustrations is when you take down an operation, 
when you do these national stings, you get the nominee owners, the 
individuals that are being paid a little bit of money so their name 
can be used but they are not really the brains behind the operation 
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and so you need to go up the chain just like you do in organized 
crime. 

Mr. Stearns. All right. My time is expired. The gentlelady from 
Colorado. 

Ms. DeGette. Thank you so much, Mr. Chairman. 

So Mr. Acosta, what you are saying is, in fact Congress did pass 
the predictive modeling, the prepayment information, it was just 
not in the same bill as Affordable Care Act, correct? 

Mr. Acosta. Correct. If memory serves, I believe Senator — I don’t 
know in the House but the Senate side Senator LeMieux added 
it 

Ms. DeGette. So it is in the law now, we can do that, right? 

Mr. Acosta. HHS has the authorization if they choose to use it. 

Ms. DeGette. The authorization. Now, both of you, I really — 
well, actually I want to thank all three of you for your testimony 
because I thought it all gave good, different perspectives on how we 
can target waste, fraud and abuse, and as we said with the last 
panel, we are all interested in rooting out waste, fraud and abuse 
in every part of the system. One of the new tools that we talked 
about that is in the Affordable Care Act and that CMS and HHS 
are using is this preventative approach so that we are moving 
away from the “pay and chase” model to the model that emphasizes 
keeping criminals out of the system to begin with, and I would as- 
sume, Mr. Acosta, you would agree with that approach, correct? 

Mr. Acosta. I entirely agree that the “pay and chase” is a bad 
approach and that we need to move 

Ms. DeGette. Thank you. 

Mr. Smith, would you agree with that? 

Mr. Smith. Absolutely agree that is not a good approach. 

Ms. DeGette. You don’t think that the preventative approach is 
a good approach, or you don’t think that “pay and chase” is a good 
approach? 

Mr. Smith. “Pay and chase” is a terrible 

Ms. DeGette. Is a bad approach? 

Mr. Smith. Yes. 

Ms. DeGette. And what about you, Ms. Rosenbaum? 

Ms. Rosenbaum. I agree that prevention is the best approach. 

Ms. DeGette. OK. Now, Mr. Smith, you testified, this was really 
quite shocking to me. You said that there is “any willing provider” 
rule which would allow even people with murder convictions to be- 
come a provider. Here is my question. Is that under statute or is 
that just under practice? 

Mr. Smith. Well, Ms. King testified this morning referring to the 
“any willing provider” rule. 

Ms. DeGette. Yes. 

Mr. Smith. Basically, CMS’s approach historically has been to let 
providers in unless they clearly had an issue in the screening proc- 
ess that CMS caught, and they weren’t very good historically at 
catching those problems. 

Ms. DeGette. OK. So do you think that there are some criteria 
that we could pass that would be absolute barriers, like, for exam- 
ple, a felony conviction where you would say, you know, you are 
just — because I know they use their discretion so they could reject 
somebody for having a felony conviction. Are you saying that it 
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would be a good idea for us to pass a bright line of certain criteria 
that they just couldn’t consider somebody if they met those cri- 
teria? 

Mr. Smith. Certainly, and there are certain criteria in statute 
that are bright lines but I would say that it goes beyond just felony 
convictions. It also goes to operating your provider network like an 
insurance company would, which is, if we have too many home 
health agencies in Miami-Dade, regardless of whether we think a 
particular provider is fraudulent, we shouldn’t let more agencies in 
the program. 

Ms. DeGette. Yes, I agree with that, but that is not a bright 
line, that is sort of a discretionary criterion, and that is what I am 
asking you. So if any of you actually think that there are additional 
bright-line criteria we should put in statute, we would appreciate 
it if you would supplement your answers and provide that to us be- 
cause I agree too, those kind of outrageous things should not hap- 
pening and sometimes I do think they slip through the cracks. 

Now, Mr. Acosta, you testified that one thing that would be real- 
ly helpful would be using these unique IDs, not using Social Secu- 
rity numbers, correct? 

Mr. Acosta. Correct. 

Ms. DeGette. Mr. Smith, do you agree with that, that that 
would be a good way to improve the system and to decrease fraud? 

Mr. Smith. Yes. 

Ms. DeGette. And Ms. Rosenbaum, do you agree with that too? 

Ms. Rosenbaum. I do. 

Ms. DeGette. I think that is a really great idea, and I appreciate 
you bringing that up. I guess that is all the questions I have. I 
yield back. 

Mr. Stearns. I thank the gentlelady. 

Mr. Murphy from Pennsylvania is recognized for 5 minutes. 

Mr. Murphy. Thank you, and thank you to the panel. This is 
very enlightening. 

Mr. Acosta, you were talking about — a couple of you, you and Mr. 
Smith were talking about issues involved with prevention versus 
chasing. Do we have any estimate of the costs involved with bring- 
ing a Medicare or Medicaid fraud case to justice, from bringing 
charges to jail time? 

Mr. Acosta. The costs, well, I can tell you that in my office, I 
received a line item of about $1 million that I supplemented with 
about $2.5 million of my own discretionary spending and so I spent 
about $3.5 million per year to prosecute cases. Now, that does not 
include the costs of the agents from HHS, GIG and FBI. 

Mr. Murphy. Do you have any kind of ratio to make decisions 
with regard to whether or not to prosecute a case, if it is less than 
$1 million or so and it is going to cost you $3.5 million? 

Mr. Acosta. We have cutoffs all the time. We don’t like to dis- 
cuss them publicly but obviously you have more cases than you can 
imaginably prosecute and so you go after the larger cases, and that 
is a problem and every now and then we prosecuted some smaller 
fraudsters because you don’t want to send the message that if you 
stay below a certain number you get away with it. 

Mr. Murphy. What would the cost of prevention be? 
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Mr. Acosta. The costs of prevention at the end of the day I think 
are much lower and much more effective. Computer programs that 
screen, for example, inhalation drugs in south Florida. Budesonide 
that I mentioned is just one hut there are a number of other inha- 
lation drugs. In one year, Miami-Dade County received $93 million 
in hillings. The next highest billing city was Cook County with $2.7 
million. That is a red flag if I have ever heard one. That is the kind 
of issue that should be caught by a computer program, and if you 
can prevent those $93 million and reduce it to the size of Chicago 
of $2.7 million, that is $90 million that you are preventing right 
there. 

Mr. Murphy. Thank you. 

And Mr. Smith, on the “any willing provider” issue, how do you 
recommend we define providers? Obviously we don’t want to stop 
people who want to start a business who are legitimate about it but 
should it involve such things as the ranking member was talking 
about something alone the lines of a criminal background check re- 
quirement or would these be people who would be at a higher level 
of screening for their first year or two? Would they be specifically 
licensed on some other level to begin with, probationary? Do you 
have any recommendations for that? 

Mr. Smith. There already exists in law provider screening re- 
quirements that would look at convictions, different things in the 
person’s past, and CMS did just recently come out with a final rule 
regarding provider screening enrollment and what they have done 
is try to tier the risk areas so a provider seeking or a person seek- 
ing to open up a new Medicare-certified durable medical equipment 
company, a home health agency or perhaps an infusion clinic would 
be tiered in a higher risk category and perhaps be screened closer 
than someone hoping to open up a new hospital, and I think that 
is a wise idea. 

Mr. Murphy. Do you think with regard to these issues, and you 
are familiar with Florida. I don’t know if you heard my questions 
before regarding the questions of the Cuban government’s role in 
this. Would we have picked up on this? Is there any thought that 
we might pick up when another country is involved perhaps in or- 
ganized crime? 

Mr. Smith. I think from a Medicaid perspective, part of it goes 
to not only to making sure you screen for certain bad actions in 
their past but also making sure you collect enough data to get the 
people on the applications so that you know what the links are, 
and one of the things that is beneficial about the predictive mod- 
eling is not just the claims analysis but also it has the capability 
of doing what I call social network analytics so you can basically 
see which people who have had an experience with a fraudulent en- 
terprise have links to other people that you might not be aware of, 
might not have their names in any applications but they are oper- 
ating in clusters and they sort of swarm around like bees with pa- 
tients and defraud the program. That type of technology has great 
opportunities for us to save money. 

Mr. Murphy. Mr. Acosta? 

Mr. Acosta. Congressman Murphy, thank you. If I could, you 
asked earlier, you referenced the list of OIG’s most wanted, and 
based on public information, my understanding is that a majority 
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of these individuals are in fact in Cuba. One of the issues that we 
had early on was that defendants were being granted bond by fed- 
eral judges on the theory that because they were Cuban nationals, 
they could not return to the island of Cuba, and in fact, they were 
then jumping bond and we had a law enforcement problem. Since 
then federal judges have actually stopped using the fact that some- 
one may not flee to Cuba as a reason to grant bond because of re- 
duced risk of flight because in fact the risk of flight to Cuba is high 
because Cuba welcomes the hard currency that they receive from 
these individuals. 

Mr. Murphy. Thank you very much. 

Thank you, Mr. Chairman. 

Mr. Stearns. The gentleman from Virginia is recognized, Mr. 
Griffith, for 5 minutes. 

Mr. Griffith. Thank you, Mr. Chairman. I do think that is very 
interesting. So even if the Cuban government is not involved, they 
still welcome these folks in because they are bringing cash with 
them? 

Mr. Acosta. They certainly welcome them in. There is some evi- 
dence that shows that there is governmental involvement as well 
but that is based on University of Miami reports. 

Mr. Griffith. Interesting. 

Professor Rosenbaum, I am just trying to do some things on 
background, and I would just ask you some questions, if I might. 
I see that you have listed some government contracts on your 
Truth in Testimony form, and I am just wondering if you could tell 
me what those contracts involve. 

Ms. Rosenbaum. Sure. I am a law professor at George Wash- 
ington University and I am the chair of the department of health 
policy in the medical center, and I am the principal investigator on 
a contract that provides analytical support to what is now I guess 
the center — as opposed to DCIIO, it’s CCIIO — to review and sum- 
marize the comments for the requests for comments and the notices 
of proposed rulemaking related to health insurance exchanges. 

Mr. Griffith. OK. And so they don’t have somebody in-house 
that is doing that? 

Ms. Rosenbaum. Oh, I am sure they must review as well but we 
do policy support work for the department and have under federal 
contracts for administrations since 1991. 

Mr. Griffith. Yes, ma’am. And is there anything else you are 
working on with HHS or CMS in regard to the Affordable Care Act 
and the regulations? 

Ms. Rosenbaum. I have no other contracts in which I am the in- 
vestigator, no. 

Mr. Griffith. All right. I appreciate that. Thank you, ma’am. 

Mr. Chairman, I yield back my time. 

Mr. Stearns. The gentleman yields back his time. I think we are 
all through. I am getting ready to close. I did have one follow-up 
for Mr. Smith. I think you talked about, or maybe it was Mr. 
Acosta, about using a data access process to cut fraud. I wasn’t 
quite sure, because Inspector General and GAO can go in and look 
at these statistics to get — who were you talking about when you 
talked about data access? 
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Mr. Acosta. One of the issues that we had early on in south 
Florida for the health care fraud initiative that later became the 
strike force, we set up a separate location where we collocated the 
agents and the prosecutors to focus on this. At the time I had re- 
quested that everyone have access to the billing data so they could 
look for aberrant billing patterns. We were finally able to obtain ac- 
cess to some data and that was restricted in appropriate ways at 
the time. 

Mr. Stearns. So you want law enforcement agents 

Mr. Acosta. Absolutely. 

Mr. Stearns [continuing]. And the prosecutors to have access to 
this data prior to — while they are investigating a crime? 

Mr. Acosta. As the data comes in, give law enforcement access 
to the CMS systems, protect privacy but give us access to the bill- 
ing patterns so we can catch the fraudsters in the act. 

Mr. Stearns. Would you need to go to a judge to get access? Or 
you just want to be able to have access to it? 

Mr. Acosta. Correct. Yes. 

Mr. Stearns. So you could call up the Health and Human Serv- 
ices and say we have this particular case, this particular modeling, 
we want you to give us access so we can look at the data? 

Mr. Acosta. Not call up HHS but actually put your investiga- 
tors, have the — we have a facility in south Florida. We would like 
a computer terminal there where we can go and see billings for X 
drugs spiked by 300 percent in the past month for these five pro- 
viders. Well, maybe that is a reason we should investigate those 
five providers. 

Ms. DeGette. Will the gentleman yield? 

Mr. Stearns. Sure. I would be glad to yield. 

Ms. DeGette. Is that a legal barrier that you couldn’t get the 
data or is that an agency policy that prevented you from getting 
the data? 

Mr. Acosta. In all candor, I am uncertain whether it is legal or 
bureaucratic. I just know it is a barrier. 

Ms. DeGette. As I said to the previous panel, I think that is 
some data that would be really helpful in these investigations, so 
if you can try to figure that out and supplement your answer, then 
we can know what we need to do to help expedite that. 

Thank you, Mr. Chairman. 

Mr. Stearns. Thank you. Let me conclude by — oh, good. We have 
another member came back. The gentleman from Texas, Dr. Bur- 
gess, is recognized. 

Mr. Burgess. Thank you, Mr. Chairman. Actually, I have been 
watching off the floor. I have a couple of constituents that are here. 
They are both serving their country, so I am making some time for 
them while this hearing is going on. 

Let me just ask a question, Ms. Rosenbaum — well, actually I 
want to ask it of Mr. Smith, but Ms. Rosenbaum made an observa- 
tion that we should empower more investigation of fraudulent in- 
surance behavior but Mr. Smith, some of your testimony to me in- 
dicated that you didn’t feel that it was necessary to have the same 
focus. Would you care to expound upon that? 

Mr. Smith. I think what I said came at maybe a slightly different 
angle. I said one of my recommendations was that the Medicare 
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and Medicaid programs continue to move away from a fee-for-serv- 
ice-based system and more toward other payment systems such as 
managed care and also to operate the programs more like a private 
insurer would. I guess it might be interesting historically to hear 
what percentage private insurers have suffered in fraud and abuse 
but that goes to their bottom line, it doesn’t go to taxpayer dollars. 
What the Medicare and Medicaid programs need to do is focus on 
protecting taxpayer dollars, and if you engage an outside managed 
care company and you pay them risk-adjusted rates, they have the 
financial incentive to stop provider fraud and abuse. If they don’t, 
it goes to their bottom line. It doesn’t hurt taxpayer dollars any 
further. 

Mr. Burgess. Yes, and that is interesting that you say that. 
When was this? June of 2009, you may be familiar with an article 
published in the New Yorker by Atul Gawande, and it was impor- 
tant to me because he was talking about Texas. I should point out 
that Texas today is 175 years old. It was 175 years ago this morn- 
ing that Texas declared its independence and became an inde- 
pendent country. But that is another story. 

Part of Dr. Gawande’s investigation in south Texas led him — I 
don’t know that he came right out and said it but he certainly im- 
plied that overutilization and overbilling of Medicare was rampant 
within the medical community in McAllen. So it bothered me. I 
know a lot of doctors, or I know some of the doctors who work 
there. We work together on border issues. So I took a trip down to 
McAllen to see for myself on the ground if I could what was going 
on, and just the point you make, Mr. Smith, was you don’t see the 
headlines in the paper that Aetna Life and Casualty has been de- 
frauded of 15 wheelchairs. It just doesn’t happen. It is always 
Medicare, Medicaid and SCHIP. It is always the public side. 

Now, Ms. Rosenbaum has some issues with private insurers, and 
I get that, but here we are talking about the actual delivery of 
care, and appropriately, it never seems to happen on the private 
sector, or if it does, perhaps they just don’t talk about it the same 
way we do on the public side. But is that your observation as well? 

Mr. Smith. It has certainly been a prevalent problem in both pro- 
grams. There was a report recently that in 2009 the Medicare pro- 
gram paid for over 420 million claims for mental health in Florida 
alone, which was four times higher than the amount paid in Texas 
and 635 times higher than the amount paid in Michigan, and to 
paraphrase Carl Hiaasen, who is a funny novelist out of Florida, 
he said no matter what you think of Floridians, there is no way 
that we are four times crazier than Texans, respectfully. Congress- 
man. 

Mr. Burgess. Well, exception taken. Yes, I was going to suggest 
perhaps they need to move to Texas and that would solve our prob- 
lem. 

Well, it is just — ^you know, it raises an important issue. What is 
happening on the private side that prevents the same problems 
that are happening on the public side. Now, we talked a little bit 
about the payment error rate, and Ms. Rosenbaum, some of that 
is truly just a coding error. Someone makes a mistake when some- 
one comes in and they write the code down and that goes into the 
payment error rate, correct? 
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Ms. Rosenbaum. Absolutely. 

Mr. Burgess. But that error rate of 9.4 percent or whatever was 
quoted to us, that is not predominantly made up of honest mis- 
takes made in tallying up the office visit. Is that correct? 

Ms. Rosenbaum. I am not sure I understand the question. 

Mr. Burgess. Well 

Ms. Rosenbaum. You mean of the total amount? 

Mr. Burgess. Yes. How much is just simple coding errors 
that 

Ms. Rosenbaum. I couldn’t begin to answer the question. 

Mr. Burgess. It wouldn’t these two guys that were on the panel 
earlier with their handcuffs and nightsticks? Just wouldn’t be in- 
volved, right? The amount of the error rate that is just attributable 
to simple coding errors is likely pretty small out of that 9.4 per- 
cent? 

Ms. Rosenbaum. I truly don’t know. I have only seen the num- 
bers aggregated. 

Mr. Burgess. Well, let us even say this. Let us say it is that 
high for just simple coding errors. Doesn’t that tell us something 
about how we should be approaching this problem, that if nothing 
else, perhaps some education of doctors and nurses and clinics 
about how to code properly would be part of what should be hap- 
pening at the level of CMS? 

Ms. Rosenbaum. Yes. I think anything and everything that can 
be done to clarify how to bill, how to file appropriate claims 

Mr. Burgess. I don’t have any data on it but I would suspect 
that number is very low, because as you recall in the late 1990s, 
there were all of these compliance audits, and I know because I 
was in practice at the time, and they were very, very severe, and 
yes, you could he put in jail, so I am just telling you I think that 
number of actual coding errors of that 9.4 percent is in fact very 
small because most physicians and nurses and nurse practitioners 
do not want to undergo that type of scrutiny because we all had 
to go through those compliance audits, we all had to put forward 
what we were doing in our offices to prevent that from happening. 

Mr. Chairman, I see I have gone over my time. Thank you for 
the indulgence. 

Mr. Stearns. All right. I thank the gentleman. 

By unanimous consent, we would like to put the document binder 
into the record, and I will conclude by saying the purpose of Over- 
sight and Investigations is to ferret out details. You have done an 
excellent job, the second panel here. We are going to recommend 
to the Health Subcommittee on Energy and Commerce a lot of the 
recommendations that have come out of this hearing and that is 
the purpose, and hopefully they will have a hearing and follow up 
with legislation. I know the Democrats think a lot of these sugges- 
tions you have made are part of Obamacare but I am not sure they 
all are, and obviously changing the Social Security number so a 
person can have a Medicare ID number that you seem to all agree 
upon is something that we should look at quickly. 

So with that, the 

Mr. Burgess. Mr. Chairman, just a point of personal privilege, 
can I recognize two of my constituents? 

Mr. Stearns. Sure. 
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Mr. Burgess. Captain Dambravo and Captain Dambravo were 
visiting me today during the hearing, and I want to thank them 
for their service to their country. If I can further relate, my rela- 
tionship with Captain Dambravo goes back some time. Without vio- 
lating HIPAA, I delivered him 27 years ago. Thank you both for 
being here with us today. 

Mr. Stearns. Thank you for being here. 

And with that, the subcommittee is adjourned. 

[Whereupon, at 1:02 p.m., the subcommittee was adjourned.] 
[Material submitted for inclusion in the record follows:] 
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Opening Statement of the Honorable Fred Upton 
Chairman, House Committee on Energy and Commerce 
“Waste, Fraud and Abuse; 

A Continuing Threat to Medicare and Medicaid.” 

March 2, 2011 

Thank you, Chairman Steams, for holding this hearing on the battle against waste, 
fraud, and abuse in our Medicare and Medicaid systems. This perpetually 
recurring problem costs taxpayers tens of billions of dollars every year. 

Along with eliminating burdensome government mandates and promoting job 
growth, I pledged in our Committee Oversight Plan to cut government spending 
through the elimination of waste, fraud, and abuse. This is a great place to start. 

$60 billion a year is lost to Medicare fraud. We are not even sure about the 
amount lost to fraud in the Medicaid system — the HHS Deputy Inspector General 
for Evaluation and Inspections wrote that CMS does not adequately capture this 
data. We can’t accurately estimate the extent of these problems in Medicaid, yet 
we are spending $674 billion over the next 10 years to expand the program. The 
Administration should end the rampant fraud in the system before vastly expanding 
it. 

Now it must be noted that enforcement efforts have increased and those involved, 
including our witnesses, should be applauded. Last year, a record $4 billion was 
recovered from fraudulent providers and suppliers and, just this month, 1 1 1 
defendants were arrested and charged with various schemes to defraud the 
government of more than $240 million. Yet, we still have a long way to go. 

Democrats will inevitably say that since we voted to repeal PPACA, we must be 
against the new tools and authorities given to HHS and CMS. I would counter that 
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the elimination of the fraudulent practices discussed today will actually be a pillar 
of our replacement efforts as opposed to the tangential treatment it received in 
ObamaCare. 

We must focus on detecting and preventing fraud before the check is out the door 
and the criminal has moved on. Fraudulent practices are increasingly sophisticated 
and we need to catch up. This January, HHS announced that it has new systems in 
place to enhance the screening processes for providers and suppliers and I look 
forward to hearing more about these efforts. 

I hope the Administration will learn what is required to eliminate the fraud in the 
system and not just put a dent in it. 

Thank you, Mr. Chairman. 1 yield back the balance of my time. 
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Opening Statement of the Honorable Cory Gardner 
“Waste, Fraud, and Abuse: A Continuing Threat to Medicare and Medicaid” 

March 2, 2011 

Mr. Chairman, combating Medicaid and Medicare fraud is draining resources in states 
throughout the country. In the State of Colorado, the Department of Regulatory Agency 
has a specific sector devoted to combating waste, fraud and abuse within Medicaid and 
Medicare. In fact, just this past October, the Colorado Senior Medicare Patrol was 
awarded a $100,000 grant to educate seniors and other Medicaid and Medicare 
beneficiaries on how to prevent fraud. Colorado has over 600,000 Medicare enrollees 
and over 526,000 enrolled in Medicaid. Specifically, Colorado’s Medicaid program pays 
out nearly $4 billion every year. Under the Affordable Care Act there will be an 
expansion of these entitlement programs. With this expansion there will certainly be 
more waste, fraud and abuse at the expense of taxpayers. 

Throughout this hearing, my colleagues and I will reference the Government 
Accountability Office’s study that classifies Medicare and Medicaid as “high risk” 
programs. Medicare has been classified as a “high risk” program since 1990. Yet, 
throughout the last 20 years, the departments throughout CMS devoted to ending this 
cycle of abuse in health care have failed to deliver results. President Obama has outlined 
that the Affordable Care Act will save money throughout our health care system by 
combating waste, fraud, and abuse in Medicare and Medicaid. However, with the 
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expansion of these entitlements, won’t this problem only become worse? Evidence 
shows that CMS has been ineffective, and yet CMS will have to monitor even more 
abuses when the eligible Medicaid population expands to over 20 million people by 2014. 
If we are truly going to save money within our health care system, we need to examine 
ways to make CMS more effective in targeting fraud. 

In 2009, Colorado was forced to institute a provider fee in order to keep Medicaid afloat 
and in order not to sacrifice coverage for those who need it. This provider fee was also 
implemented for a state-wide Medicaid expansion program. As a result, Colorado will 
see a rise in claims of Medicaid fraud. Is the federal government willing to assist states 
in combating Medicare and Medicaid fraud? My fear is that with rising entitlements 
enrollees, the bill for the abuses in the system will fall directly on state budgets. I look 
forward to the witnesses addressing these issues. 

I thank the witnesses for being here, and I yield back the balance of my time. 
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Statement from Representative John D. Dingell 
House Committee on Energy and Commerce 
Subcommittee on Oversight and Investigations 
“Waste, Fraud, and Abuse: A Continuing Threat to Medicare and Medicaid.” 

March 2,2011 


Thank you, Mr. Chairman. 

This Committee has a long, proud history of oversight and investigations into waste, fraud and abuse in 
all sectors of our government. Some of these investigations have turned up improper contracts or 
wasteful government purchases, others local con artists trying to rob the neediest populations of their 
assistance. Regardless, all have proven that we must continue to dedicate the personnel and financial 
resources necessary to crack down on waste, fraud and abuse, while also preventing and detecting 
these practices before they happen. 

The Affordable Care Act included a number of anti-fraud provisions that are helping CMS today to 
increase their efforts to crack down on fraud and also provide the appropriate tools to prevent fraud 
before it occurs. Some of these provisions include: 

• New enrollment requirements that will help CMS to identify and eliminate fraudulent providers 
prior to any payment from Medicare and Medicaid, 

• Stronger penalties for fraudulent providers, 

• Requirements for providers to establish plans on how they will prevent fraud, 

• Increased funding for fighting Medicare and Medicaid fraud, and 

• Enhanced data sharing that allows CMS, DOJ, states and other federal health care programs to 
share information. 

The Obama Administration has acted swiftly to implement these provisions, issuing final rules on 
home health and hospice referrals in November 2010 and in provider and supplier screening 
requirements, enrollment moratoria and payment suspension in January 2011. 

The use of these new tools will help CMS to continue to fight back against criminals who are raiding 
two of our most important health care programs. This is critical to protecting the services American 
seniors and families rely on, but also to reducing the deficit. Since 1 997 the Health Care Fraud and 
Abuse Control Program has recovered and returned $18 billion to the treasury. According to HHS and 
DOJ, for every dollar spend on Medicare and Medicaid fraud enforcement spent since that time, $4.90 
has been recovered and returned to taxpayers. 

I was fortunate enough to join the Detroit Strike Force Team this past summer for a ride-along to 
witness first hand the good work the strike force teams are doing to identify and stop fraud in so-called 
health care fraud hotspots. Because of the strike force’s efforts in Detroit, more than 40 people have 
been convicted, 90 others have been indicted and courts have ordered criminals to repay over $23 
million to Medicare. As the first Member of Congress to ever join any unit of the Medicare Fraud 
Strike Force for a ride-along, this visit reinforced the need to protect the poor, the elderly and the sick 
from crooked criminals who have no shame in stealing Medicare from those in need. 

I look forward to hearing from our witnesses today and hope to learn more about what Congress can do 
to crack down on waste, fraud and abuse before it occurs. 
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John Spiegel 

Additional Written Questions for the Rceord 
Energy & Commerce O&I Subcommittee 
“Waste, Fraud and Abuse; A Continuing 
Threat to Medicare and Medicaid” 

March 2, 2011 


The Honorable Cliff Stearns 


1. Several of our law enforcement witnesses testified about the importance of having 
access to real-time claims data and provider profiles. Why don’t they have access to 
this data now? 

Answer: CMS is committed to sharing all available data with our law enforcement partners. 

The Affordable Care Act increases data sharing between Federal entities to monitor and assess 
high risk program areas and better identify patterns of improper payments and potential sources 
of fraud. CMS is expanding its Integrated Data Repository (IDR) which is currently populated 
with five years of historical Part A, Part B, and Part D paid claims, to include near real time pre- 
payment stage claims data; this additional data will provide the opportunity to analyze previously 
undetected indicators of aberrant activity throughout the claims processing cycle. CMS intends 
to develop shared Medicare and Medicaid data models and is pursuing data sharing and matching 
agreements with the Department of Veterans Affairs, the Department of Defense, the Social 
Security Administration, and the Indian Health Service to identify potential fraud, waste, and 
abuse throughout Federal health care programs. 

CMS has made important strides in making data available more quickly and efficiently to our 
law enforcement partners. We have been working to give access to data in the interim; OIG and 
DO.I currently have access to data through the Next Generation Desktop and through One PI 
business intelligence tools. 

2. Is the lack of access a problem that can be fixed at an administrative level or is there 
a statutory and/or regulatory barrier? 

Answer: We are working to increase our data sharing with law enforcement partners by 
implementing the new authorities granted in the Affordable Care Act. The Affordable Care Act 
increases data sharing between Federal entities to monitor and assess high risk program areas and 
better identify patterns of improper payments and potential sources of fraud and provides the 
HHS Office of Inspector General and the Attorney General access to claims and payment 
databases related to Medicare, Medicaid, and CHIP for the purpose of conducting law 
enforcement and oversight activities, consistent with applicable information, privacy, security, 
and disclosure laws. 

3. Which city/county in the United States has the most Medicare-certified home health 
agencies per Medicare beneficiary? Wbat is that ratio? What is the ratio of the 
next closest city'/county? 
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Answer: Data indicates that access to home health services is adequate for Medicare 
beneficiaries. According to MedPAC’s March 201 1 Report, 99 percent of Medicare 
beneficiaries live in a zip code where a Medicare Home Health Agency (HHA) operates, and 98 
percent live in a zip code with two or more agencies. Further, MedPAC reports that HHAs have 
record levels of participation in Medicare, with the number of HHAs rising faster than the 
growth in number of beneficiaries. 

Based on 2009 data, Canovanas County, Puerto Rico has the highest ratio of enrolled Medicare- 
certified HHAs per Medicare beneficiary. Canovanas County has only one HHA and the county 
has 29 Medicare beneficiaries for a ratio of 3.45%. Greeley County, Kansas has the next highest 
ratio of Medicare-certified HHAs per Medicare beneficiary, with one HHA and 277 Medicare 
beneficiaries (a ratio of 0.36%), As further context, the nationwide ratio of Medicare-certified 
HHAs per Medicare beneficiary is 0.02%, and the county with the largest number of HHA 
providers, Miami-Dade County, Florida has a ratio ofO.17% with 608 HHAs serving 360,679 
Medicare beneficiaries. 

We would be happy to discuss this issue with you further to better understand your underlying 
concerns. 

4. Has CMS implemented GAO’s recommendation that Medicare provide each 
ordering physician with a monthly summary of items and sendees for which his or 
her name and physician identifier has been used to justify billing Medicare? If no, 
why not? 

Answer: GAO recommended in April 2007 that CMS identify physicians with inefficient 
practice patterns. The Medicare High Risk report noted that CMS has begun to provide feedback 
to physicians but that feedback could be enhanced. MIPPA 2008 required CMS to establish a 
confidential feedback mechanism to physicians, and under Section 3003, the ACA has expanded 
this program. GAO estimated that these program enhancements could potentially save Medicare 
$336 billion. 

5. Has CMS considered using unique Medicare numbers rather than Social Security 
numbers as Medicare beneficiary identifiers? If CMS has considered this and 
rejected it, why? 

Answer: CMS has considered using unique Medicare numbers and has determined that there are 
considerable costs associated with changing the Medicare beneficiary identifier, not only for 
CMS but also for our public and private sector partners. The SSN identifier in the Health 
Insurance Claim Number (HICN) is the basis of eligibility for Medicare, and is integrated in 
more than 50 CMS systems, as well as communications with our partners in the Social Security 
Administration, state Medicaid departments, private Medicare health and drug plans, and over 2 
million health care providers and suppliers. The risks of disruptions in beneficiaries’ access to 
care are considerable. 
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I want to emphasize, however, that CMS shares your concerns about the importance of 
safeguarding and protecting Medicare beneficiaries from identity theft. We have taken many 
important steps regarding the display of SSNs or HICNs on Medicare cards. We removed the 
SSN from various notices and publications sent to beneficiaries, and from beneficiary 
reimbursement checks. We prohibited Part C and D Plans from using the SSN or HICN as a 
beneficiary identifier. We have also taken action to educate beneficiaries about steps they should 
take to prevent identity theft and fraud, including posting information on the CMS website, and 
adding information to the “Medicare & You” Handbook. 

6. What is the total amount of Medicare overpayments initially identified by the 

contingency fee based Medicare Recovery Audit Contractors to date? How much of 
that amount has been recovered by CMS? How much has been successfully 
challenged by the providers that were the targets of those audits? 

Answer; Recovery Auditors have proven successful at identifying and correcting Medicare Fee- 
For-Service (FFS) improper payments. In the demonstration project. Recovery Auditors 
corrected $1.03 billion in improper payments, including approximately $990 million in 
overpayments collected. Since the inception of the permanent Medicare FFS Recovery Audit 
program, as of March 1, 201 1, the contractors have corrected a total of $261.5 million in 
improper payments, including $43.6 million in underpayments corrected and $217.9 million in 
overpayments collected. 

CMS actively monitors the national Recovery Audit program and makes necessary adjustments 
to maintain a balance between provider burden (both financial and administrative) and increasing 
recoveries, CMS is committed to working with the Recovery Auditors, the provider community, 
and others to continuously improve the program and refine ongoing operations. 

Regarding the appeals process, CMS has received successful feedback. During the Recovery 
Audit demonstration 8.2% of overpayment determinations were both challenged and overturned 
on appeal. Preliminary experience from the national program indicates the percentage of claims 
appealed may be less. 


The Honorable Joe Barton 


1. How often does CMS conduct internal audits to determine whether people working 
for CMS or other enforcement ageneies are participating in scams? 

Answer: CMS’ Office of Acquisition and Grants Management (OAGM) adheres to all internal 
control requirements in the Federal Acquisition Regulation (FAR) in managing CMS funds and 
administering CMS grants and contracts. Contractors are required to follow strict reporting rules 
for any alleged improprieties. CMS acquisition personnel are subject to procurement integrity 
rules and undergo extensive training to ensure our employees maintain the public trust. CMS 
Contracting Officers are also required to aiuiually file financial disclosure forms that are 
reviewed for potential conflicts of interest. 
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The CMS Ethics Office, as required by Executive Order, develops an Annual Training Plan for 
CMS employees at the beginning of each calendar year. These plans are designed to address 
internal ethics issues, such as impropriety or conflicts of interest. Training conducted under the 
Plan is periodically targeted to specific responsibilities, such as contracting and procurement or 
the administration of Federal funds, benefits, and grants. In addition, managers and other CMS 
leadership positions are required to undergo internal control trainings on a regular basis. All 
CMS employees are required to take annual ethics training, which is constantly and consistently 
performed through the calendar year on a scheduled basis throughout CMS’ Baltimore 
headquarters and the Washington D.C. and Regional Offices. 

Additionally, in the event that an employee was suspected of misconduct, he/she would be 
referred to the HHS Office of the Inspector General (OIG). Managers are required to inform the 
Chief Operating Officer when it is known to them that a matter has been referred to the OIG. 

We do not have any reason to believe that CMS or other enforcement agency employees pose an 
increased risk of fraud to the federal health care programs that would require increased 
screening and monitoring over and above our current internal training. 

2. What rate of fraudulent activity do these internal audits reveal? 

Answer: There is nothing to suggest that CMS or other enforcement agency employees pose an 
increased risk of fraud to the federal health care programs that would require an increased 
screening and monitoring over and above our current internal training. 

We believe that our existing and newly implemented program integrity controls, including risk- 
based screening of providers and suppliers, identifies fraudulent schemes, regardless of the 
nature of the relationship of the scammer to CMS. Should an employee be found to have 
participated or aided in a fraudulent scheme, the individual would be prosecuted to the full extent 
of the law. 


The Honorable Lee Terry 

1. How much did CMS spend in 2008, 2009, and 2010 on fraud prevention? 

Answer: The Medicare Integrity Program has been the primary funding source for CMS’ efforts 
to prevent and detect fraud, waste, and abuse. CMS does not assign costs specifically to fraud 
prevention or detection. In the fiscal years for which information has been requested, “Prepay 
Medical Review” and “Provider Outreach and Education” could be considered to be the primary 
means of preventing fraud. However, the intent of both programs is to ensure that payments are 
made properly. This is not the same as preventing fraud. 

In addition to the activities listed above, in FY 2010 CMS embarked on an $8 million fraud 
prevention campaign. These funds educated beneficiaries through fraud summits, public service 
announcements, and other activities to help beneficiaries better understand their Medicare 
Summary Notices, the services being paid, and potential fraud schemes. CMS also began to 
develop initial activities for implementing innovative analytic techniques. This included the 
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launch of geospatial technology that maps “hot spots” for beneficiary complaints of fraud; 
implementation of a “rapid response” process for the quick development of new leads based on 
proactive analysis and enhancing a central database of compromised beneficiary and provider 
identification numbers and using the database to screen providers, trigger administrative actions, 
and support law enforcement actions. 

2. How much did CMS spend in 2008, 2009, and 2010 on fraud detection after claims 
were already paid? 

Answer: On the detection side of the equation, programs such as “Audit” also have a primary 
purpose of ensuring that proper payments are made, not necessarily to detect fraud. “Benefit 
Integrity” on the other hand, focuses on fraud detection. However, even here, there are sentinel 
effects of the conducted activities that result in fraud prevention. 

Fraud prevention and detection falls within a continuum of activities and it is difficult to provide 
an accurate allocation of costs between them. This chart below gives a break out of Medicare 
Integrity Program activities and cost. 


Medicare Integrity Program 

(Dollars in Millions) 



2008 

2009 

2010 

Audit 

169.6 

124.9 

89.1 

Medicare Secondary Payer 

117.5 

105,8 

105.3 

Medical Review 

121.7 

62,1 

48.4 

Provider Outreach and Education 

37.1 

22.4 

20.9 

Benefit Integrity 

103.8 

121.8 

135.8 

Provider Enrollment 

23.5 

19.7 

17 

CFO/comprehensive Error Rate Testing 

12,0 

15.9 

25.3 

Managed Care Integrity Program 

5.5 

5.2 


Plan Bid Review and Audit 

12.7 

32.3 


SAS 70 Internal Control Reviews 

0.0 

2,0 

1.5 

MACs/DMACs 

56.6 

171.6 

206.7 

DRA Specialty Hospital Study 

0.1 

0.0 

0.0 

Drug Benefit 

27,2 

7.1 


IT Projects 

30.2 

36.8 

47.4 

Medi-Medi 

36.0 

48.0 

60.0 

Mandatory Totals 

753.5 

775.6 

757,4 

Fraud Response Initiative 


53.9 

51.2 

Part C & D Oversight 


36.6 

101.4 

Other PI Activities 


8.2 

14,5 

IT Projects 


47.6 

19.7 

Discretionary Totals 


146,3 

186.8 
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Grand Totals 753.5 921.9 944.2 


3. What percentage of CMS’ total budget do these figures represent? 

Answer; For 2010, the total CMS Medicare expenditures totaled $525,6 billion; the Medicare 
Integrity spending totaled $944 million, or approximately 0.2% of the total CMS budget. 

4. How much does the private sector spend to prevent and detect fraud? 

Answer: CMS does not have access to information on private industry spending on fraud 
prevention and detection efforts. 

The Honorable Phil Gingrev 

1. How much waste, fraud, and abuse is in the private sector versus Medicare and 
Medicaid? 

Answer: CMS is not an authority on waste, fraud, or abuse specific to the private sector and 
does not have access to this information. However, we know that private sector health care 
programs are vulnerable to some of the same fraud schemes as Medicare and Medicaid. The 
Department of Health and Human Services Office of the Inspector General has worked joint 
cases with private sector health plans in which perpeuators were defrauding both our public 
programs and private sector plans. Because public and private sectors face common challenges 
in fighting fraud and keeping fraudulent providers at bay, through our fraud summits and other 
provider outreach activities, we are working together and building partnerships with the private 
sector to develop common solutions to this problem. 


The Honorable Steve Scalise 


1. What do you estimate is the cost of defensive medicine to the Medicare and 
Medicaid system? 

Answer: While many health care practitioners would freely admit that defensive medicine 
occurs in public and private health care systems, there is no recognized way to define “defensive 
medicine” practices and to quantify these costs to the American health care system. 

Nevertheless, we should scale back the excessive defensive medicine that reinforces our current 
system, and shift to a system where we are providing better care - rather than simply more 
treatment. 

The President has expressed his support for reforms to our medical liability system to ensure that 
it improves the quality of care and patient safety, fairly and expeditiously compensates patients 
who are harmed by medical negligence, reduces liability premiums and the costs associated with 
defensive medicine, and weeds out frivolous lawsuits. 
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To that end, before the passage of the Affordable Care Act, the Administration established a $25 
million initiative ($23 million in grants; $2 million for an evaluation) to support efforts by states 
and health systems to implement and evaluate patient safety and medical liability reforms. This 
is the most ambitious effort to date by HHS and the largest government investment connecting 
the medical liability system to quality and safety rather than just negligence and punishment. 

Building on that effort, the President’s FY 2012 Budget includes $250 million in grants to states 
to reform their medical liability laws. The Department of Justice, in consultation with the HHS, 
will administer this program. The goal of these reforms is to fairly compensate patients who are 
harmed, reduce providers’ insurance premiums, weed out frivolous lawsuits, improve health care 
quality and patient safety, and reduce “defensive medicine” costs. States could propose reforms 
to their medical malpractice system through various approaches, such as: 

• Health courts 

• Safe harbors 

• Early disclosure and offer 

• Other legal reforms (these reforms could include some that were proposed by the 
President’s National Commission on Fiscal Responsibility and Reform such as modifying 
the “collateral source” rule or replacing joint-and-several liability with a fair share rule). 

In addition, the Affordable Care Act authorized demonstration grants to state to develop, 
implement, and evaluate alternatives to current medical tort litigation. 

The Honorable Sue 'Wilkins Mvrick 

1. Do states have to report fraud estimates to CMS? 

Answer: While States are not required to report fraud estimates to the Centers for Medicare & 
Medicaid Services (CMS), States are required to participate and report on activities to prevent or 
address fraud in the Medicaid program. Such activities include State Program Integrity Reviews, 
State Program Integrity Assessments, Audit Medicaid Integrity Contractors, and State Medicaid 
Fraud Control Units. See below for more detail on each of these activities. 

State Program Integrity Reviews. Triennial State program integrity reviews play a critical role in 
how CMS provides effective support and assistance to States in their efforts to combat provider 
fraud and abuse. The reviews are comprehensive, including examinations of provider 
enrollment, provider disclosures, program integrity, managed care and the State's relationships 
with the Medicaid Fraud Control Unit (MFCU). See the CMS website at 
httn://wwvv.cms.gov/Fi'audAbuseforProfs/05 StateProgramlntegritvReviews.asD#ToDOfTage for 
more details. 

State Program Integrity Assessment (SPIA). SPIA is an annual activity to collect State Medicaid 
program integrity data, develop profiles for each State based on these data, determine areas to 
provide States with technical support and assistance, and develop measures to assess States’ 
performance in an ongoing manner. SPIA represents the first national baseline collection of data 
on State Medicaid integrity activities for the purposes of program evaluation and technical 
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assistance support. In FY 2009, CMS completed the first national collection of SPIA data. With 
this information, States and CMS can identify areas of opportunity to build on already effective 
practices and to identify areas for improvement. Individual State reports, a complete dataset, and 
a high-level executive summary of the results are available on the CMS website at 
hltp://www.cms.gov/FraudAbuseforProfs/l 1 SPIA.asp , 

Audit Medicaid Integrity Contractors (Audit MlCs). Audit MICs are entities with which CMS 
has contracted to perform audits of Medicaid providers. The overall goal of the provider audits is 
to identify overpayments and to ultimately decrease the payment of inappropriate Medicaid 
claims. Audit MICs prepare draft audit report and CMS, the State, and the audit provider review 
and comment on the draft report. Once finalized, the report and any identified overpayments are 
sent to the State. The State then pursues the collection of any overpayment in accordance with 
State law. A CMS Fact Sheet on Audit MICs can be found on the CMS website at 
http://www.cms.gov/ProviderAudits/Downloads/miDfactshcet.pdf 

State Medicaid Fraud Control Units (MFCUs). Under the oversight of the Department of Health 
and Human Services’ Office of the Inspector General (FIHS-OIG), the mission of the MFCUs is 
to investigate and prosecute Medicaid provider fraud and patient abuse and neglect. MFCUs 
provide an annual report to OIG outlining their success in detecting, investigating, and 
prosecuting Medicaid fraud and patient abuse and neglect cases. In FY 2009, MFCUs reported 
recoveries of $ 1 .3 billion in court-ordered restitution, fines, civil settlements, and penalties. They 
also obtained 1,331 convictions. MFCUs reported a total of 642 instances in which civil 
settlements and/orjudgments were achieved. For more information on MFCUs, visit the HHS- 
OIG website at httD://oig.hhs.gov/fraud/mfcu/ . 

2. What other resources or authorities do you need from Congress to prevent and 
detect waste, fraud, and abuse in Medicare and Medicaid? 

Answer: The Administration’s FY 2012 budget continues to make fighting health care fraud 
and reducing improper payments a top priority. These efforts will safeguard public funds and 
send a clear message that fraud and waste in our Federal health care programs will not be 
tolerated. 

The Budget Request includes $270 million increase in discretionary program integrity resources 
as part of a multi-year investment to enable HHS and its partners to take ground-breaking steps 
to detect, prevent, and prosecute heath care fraud. The Budget also proposes a series of new 
legislative authorities that will strengthen existing program integrity oversight in Medicare and 
Medicaid. If enacted, these authorities will show real, measureable results, and are estimated to 
save $32.3 billion over ten years. Fully funding the Administration’s FY 2012 budget request 
will provide the appropriate level of resources for CMS and its law enforcement partners. 


The Flonorable Cory Gardner 


1. What percentage of the 4.4 million elaims CMS gets per day do you review more 
elosely than the automatic claims edits? 
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Answer: The Medicare Fee-for-Service (FFS) program processes over 1 billon claims armually, 
which are submitted by over 1 million providers. The claims are paid by a network of claims 
processing contractors who make payments to the providers in accordance with Medicare rules 
and regulations; perform pre-payment review of selected claims; and educate providers about 
how to submit accurately coded claims that meet Medicare medical necessity guidelines. 

While all claims submitted to Medicare are screened by many system edits prior to payment, 
claims are generally paid without requesting the supporting medical records. Less than 0.002 
percent of claims are reviewed against the supporting medical records prior to payment. Due to 
the volume of claims received, CMS relies on system edits and the post-payment review of 
claims to identify erroneous payments. 

2. How many levels of review are there and what is included in each step of review? 

Answer: Medicare contractors conduct several types of medical review and target their reviews 
on services and items that pose the greatest financial risk to the Medicare program. Claims that 
require a documentation review are only subjected to that one level of review. The following 
types of review are conducted: 

• Automated reviews are completed at the system level, using available electronic 
infomration without the intervention of personnel, 

• Routine reviews are completed by specially trained nonclinical staff who review the 
nonclinical portions of claims to ensure documentation compliance. For example, they 
may review documentation to confirm that an order was written before a service was 
provided. 

• Probe reviews are complex reviews conducted to verify that the program vulnerabilities 
identified through a contractor’s data analysis exist and require additional education and 
pos.sible further review, 

• Complex reviews are completed by licensed medical professionals who use clinical 
review judgment to review claims against supporting medical records. 
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THE WALL STREET JXML 

WSJiiXni 

February 2. 2010, 8:47 AM ET 

Reminder: Medicare, Medicaid Are Gobbling Up the Budget 

President Obama's budget is still in the news this morning, and there’s plenty of 
interesting health stuff in there. But it’s worth pausing to note that the big drivers are 
mandatory spending on Medicare and Medicaid — huge, rapidly growing costs that are 
outside the purview of Obama’s (or any president’s) annual recommendations for 
discretionary spending. 

Take a look at the table on pages 5-7 of this PDF, which explains Obama’s proposed 
funding of the Department of Health and Human Services. 

Total discretionary outlays (funding for CDC, NIH, that sort of thing) are $82.8 billion. 
Sure, that’s a lot of money. But mandatory outlays for Medicare under existing law are 
$489.3 billion; the figure for Medicaid is $264.5 billion. 

Under current law, spending on Medicare and Medicaid is set to rise by $58 billion 
between 2010 and 201 1 , Throw in the extra $25.3 billion in Medicaid funding proposed 
by the president, and just the year-over-year growth for Medicare and Medicaid is 
comparable to all of the HHS discretionary spending combined. 


http://blogs.wsj.eom/health/2010/02/02/rerninder-medicare-medicaid-are-gobbiing-up-the-budget/tab/print/ 
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Medicare Fraud Costs Taxpayers More Than $6o 
Billion Each Year 

In Easy to Execute Scams, Criminals Rip-Off Taxpayers, Make Millions and Run 

BY CYNTHIA MCFADDEN AND ALMIN KARAMEHMEOOVIC 

MARCH 17, 2010 

A four month "Nightline" Investigation into Medicare fraud makes one thing perfectly clear: this is a crime that pays 
and pays and pays. The federal government admits that a staggering $60 billion is stolen from tax payers through 
Medicare scams every year. Some experts believe the number is more than twice that. 

Fraudulent pharmacies, clinics and medical supply companies seem to pop up like mushrooms in South Florida, the 
area widely considered to be ground zero in the fight against a crime that requires little training and involves few 
risks. 

Former car mechanics and drug dealers, bus boys and clerks can be involved in individual scams, taking tens of 
millions of dollars every year from the government program designed to provide health care to the nation's elderly. As 
one government official told "Nightline," having a Medicare license is having a license to steal. 

The victims of the schemes? American taxpayers. 

Federal agents Brian Piper and Omar Peres of the Office of inspector General are part of a special strike force in 
South Florida on the trail of some of the most elusive and richest criminals in the U.S. 

We rode along with them over two days recently, as they ran down tips and knocked on doors in pursuit of people 
defrauding Medicare. 

Our first stop with Piper and Peres is a place that is registered as a pharmacy that Medicare has paid $1 million to in 
two months. When they arrive, there is nobody there. The shelves are nearly bare. The chances are that it never sold 
so much as an aspirin. 

It looks to be what the agents say is a typical scam; a fraudster buys a pharmacy along with its Medicare license and 
entire patient database. This one was sold five months ago for just $45,000. 

"They've left the patient records for all of the Medicare benefidaries that they were billing. So if these records had 
been thrown in the trash, they could be found by anyone." said Piper. 

Piper and Peres have often seen the scam before. 

"This is actually someone's name. Medicare number, address, phone number, and this person may not even know 
that they were being billed yet." Piper noted. 

The scheme is relatively low-risk and requires little investment. Investigators allege that one person at a computer 
terminal could have submitted the million dollars worth of claims this pharmacy sent to Medicare In two months, 
before shuttering the place and disappearing. 

"You don't have to hire anyone," said Piper. "If you buy an existing company like has happened here, one person can 
come in at night -- midnight -- submit all the claims and you never even have to open the business.” 

It's that easy because Medicare is based on trust. When the program was introduced in the 1960s it was assumed 
that no one would try to defraud a system designed to take care of the health needs of the elderly. The government 
was required to reimburse vendors in less than 30 days. To this day, in 99.9 percent of the cases. Medicare "auto- 


1 
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Medicare FraixJ Costs Taxpayers IVtore Than $60 Easy to Execute Scams, Criminals Rip-Off 

Taxpayers, Make Millions and Run By Cynthia McFadden & Almin Karamehmedovic 

adjudicates" claims within 30 days, in other words, the computer decides if the right codes are in the right boxes. If 
they are, jackpot, the checks are sent. 

'That means that if you check the right boxes and fill out the right forms, you're going to get paid," said Kirk Ogrosky, 
who until recently was the federal prosecutor in charge of all criminal Medicare fraud at the Department of Justice. 

Ogrosky said criminals' forms are often filled out more completely than actual health care providers'. 

"Real hospitals and doctors who are struggling every day to keep up with the papenA/ork sometimes miss things 
...whereas if you are a criminal trying to steal, all the forms look perfect every time because the whole goal of the 
enterprise is to check the right boxes," he said. 


Medicare Makes Life Easy for Criminals 

Medicare makes life very easy for criminals. Unlike credit card companies that stop payment the second a suspicious 
charge is made, "Nightline” learned Medicare is slow to respond even when people call to tell them about fraud. 

Paula Teller spent three years trying to convince Medicare that fraudulent charges were being made using her 
Medicare number. 

"Every week there was a charge of maybe $1 .000 or $2,000," Teller said. "Thousands of dollars for treatments that I 
didn't even know what they were actually - some kind of diabetes medication. ... I called Medicare and they kind of 
questioned if I was sure I hadn't had it done." 

Teller estimates that $50,000 in phony claims was made under her Medicare card, 

Judge Marshall Ader, who sat on the Florida state bench for decades, said he even had trouble getting Medicare to 
pay attention. When he saw that Medicare was being billed for two prosthetic legs using his Medicare number - for 
the record he has both of his legs - he hit the roof. 

"I saw that there was a report for some prosthesis that I. of course, didn't use and had never used," said Ader, who 
has both of his legs and no need for prosthesis. "The bill was something like $30,000." 

"I called Medicare, the investigative fraud unit ...Nobody seemed to care," he said. Ader told us it took over a year to 
sort out the situation. 

"I saw that there was a report for some prosthesis that I, of course, didn't use and had never used," said Ader, who 
has both of his legs and no need for prosthesis. "The bill was something like $30,000," 

"I called Medicare, the investigative fraud unit ...Nobody seemed to care," he said. Ader told us it took over a year to 
sort out the situation. 

Criminals Get Rich Quick 

Meanwhile, criminals continue to get rich quick, often buying expensive toys from helicopters to sports cars and race 
horses, from these easy-to-execute scams. 

Another variation of the scam took place at a phony AIDS clinic, where a patient being paid off by fraudsters made a 
fake Medicare claim at the facility. "Nightline" was provided with undercover video inside the clinic documenting the 
scam in action. 


http://abcnews.go.eom/Nightline/medicare-fraud-costs-taxpayers-60-binion- 
year/story?id=l 0126555&page=3 
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The video shows the informant following the fraudsters into a back room, where he gets a cash kickback for use of 
his Medicare number. 

According to Piper, Medicare was billed three times a week at this clinic and paid out $10,000 per claim - more than 
$30,000 a week for a service that was never provided. 

"That's just per patient. One patient," he said. “So when you get a group of 10, 20, 30 patients you can see what a 
lucrative crime this was." 

The clinic was closed, but not before Medicare paid the fraudsters $2 million. The criminals were sent to prison in 
sentences ranging for three to seven years. 


Prosecuting Medicare Fraudsters 

Plenty of criminals are arrested by the FBI and the Office of Inspector General. Just recently in Detroit, where another 
strike team is located, agents conducted an early morning raid on a clinic that had collected $15 million in an alleged 
Medicare scam. 

U.S. Attorney Jeffrey Sioman spearheads prosecutions in South Florida. He meets with us in a secret location and 
shows us the row after row of pending cases representing what he calls “over a billion dollars of fraud. .. 
probably... two billion.’’ Sioman said: "there is definitely more out there.” 

Despite the fact that the South Florida strike force prosecuted approximately 1 70 cases last year, all their hard work 
hardly makes a dent. 

"That's the stunning thing about It, ..from my standpoint, relatively simple fixes can be instituted and aren't then 
something's terribly wrong," Sioman said. 

Obama Administration on Stopping Medicare Fraud 

Earlier this week President Obama said stopping such fraud would help fund his ambitious health care plan. 

"Nightline" asked Obama’s Secretary of Health and Human Services, Kathleen Sebelius, how much money the 
administration is counting on saving over the next ten years. 

"Well, right now, I think the estimates are somewhere in the $25 billion range." she said. 

While that may sound tike a lot, at the rate things are going, it isn't very ambitious; $1 trillion is likely to be stolen from 
Medicare in the same period. 

Sen. Charles Grassley, R-!owa, who has been holding hearings for decades on Medicare fraud, said he's worried the 
president’s health care bill falls to address the problem at the heart of the matter: pay and chase. Medicare pays the 
criminals and then chases after them. 

'What's in there is good," says Grassley, referring to the Medicare fraud provisions In the Administration's bill, "but it 
isn't as fundamental of a ftx as we need. The fix is to shut down the check-wiring for suspected fraud until you find out 
whether there's real fraud of not." 

When asked why the fix isn't part of the president's health care bill, Grassley said: "I hope it’s an oversight, but except 
for saying It’s an oversight. I can't give you a reason why it’s not in there." 


http://abcnews.go.eom/Nightline/medicare-fraud-costs-taxpayers-60-billion- 
year/story?id= 101265 5 5&page=3 
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So we asked Secretary Sebelius. She said It was not an oversight. 

"1 think we have a difficult balance here," she said in an interview with "Nightline.” ‘They can't just slow down 
payments willy-nilly because that's an unfair burden on the majority of providers who are legitimate." 

in fact, Sebelius’ staff later told us that despite what Sen. Grassley said, they already have the power to stop 
payments — though it's an option they rarely use. even when there is clear evidence of fraud. 

"Medicare very rarely suspends payment. Many of the criminals that are stealing from Medicare file the same claims 
over and over again for different patients," Ogrosky said. "If you have one hundred patients getting a dosage of a 
drug intended for chemo, they would be getting the same amount of the drug regardless of their body weight, 
regardless of the state of their diseases, regardless of their condition. ..if you were to ask any doctor, they would tell 
you that’s impossible." 

That should be good evidence of fraud, he said, yet over and over again, Medicare pays. Meanwhile, the vicious 
cycle continues; law enforcement continues to do its best to chase down the bad guys and the system continues to 
pump out the checks to the cheats. 


http://abcnews.go.eom/Nightline/medicare-fraud-costs-taxpayers-60-billion- 
year/story?id=l 0 1 2655 5&page=3 
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Testimony of; 
Daniel R. Levinson 
Inspector General 
U.S. Department of Health & Human Services 


Good afternoon Chairman Obey, Ranking Member Tiahrt, and other distinguished Members of 
the Subcommittee. I am Daniel Levinson, Inspector General for the U.S. Department of Health 
& Human Services (HHS). I thank you for the opportunity to appear before you today to discuss 
the Office of Inspector General’s (OIG) efforts to combat health care fraud, waste, and abuse in 
Medicare and Medicaid. I also thank you for your continued commitment to fiirthering our 
shared goal of safeguarding the fiscal integrity of these programs against those who would divert 
resources that are vital to so many Americans. 

Medicare and Medicaid fraud, waste, and abuse cost the taxpayers billions of dollars each year 
and put the programs’ beneficiaries’ health and welfare at risk. The growing numbers of people 
served by these programs and the increased strain on Federal and State budgets caused by the 
economic recession lurther exacerbate the impact of these losses. It is critical that we strengthen 
oversight of these essential programs and reduce their vulnerability to fraud, waste, and abuse. 

My testimony today will describe the nature and scope of the health care fraud, waste, and abuse 
that we have identified; strategies and recommendations to fight these problems; and OIG’s role 
in fraud prevention, detection, and enforcement, including our highly productive collaboration 
with our colleagues in HHS and the Department of Justice (DOJ). It will also describe how we 
have deployed our resources and the results we have achieved, as well as our plans for the new 
appropriations requested in the President’s Budget for fiscal year (FY) 2011. 

OIG’s Mission to Protect the Medicare and Medicaid Programs and Beneficiaries 

OIG fights health care fraud, waste, and abuse through a nationwide program of investigations, 
audits, evaluations, and enforcement and compliance activities. Our FY 2010 appropriation 
included approximately $232 million in funding dedicated to protecting the integrity of Medicare 
and Medicaid.’ In recognition of the value and impact of OIG’s oversight and enforcement 
activities, the President’s Budget for FY 201 1 requests approximately $272 million in Medicare 
and Medicaid integrity funding for OIG, a net increase of $40 million. With this increased 
funding, OIG will expand its activities in support of the joint HHS-DOJ Health Care Fraud 
Prevention and Enforcement Action Team (known as HEAT and described in more detail 
below), including expanding the OIG-DOJ Medicare Fraud Strike Forces to 13 new locations. 

OIG’s funding is used to hire and support investigators, auditors, evaluators, attorneys, and 
management and support staff to carry out our mission and functions. OIG is comprised of more 
than 1,500 professionals who perform comprehensive oversight and enforcement activities for 
HHS programs, including: 


‘ OIG’s total appropriation for FY 2010 was approximately $282 million, which also included $50 million to 
oversee the more than 300 other HHS programs. 
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> Office of Investigations : conducts criminal, civil, and administrative investigations of health 
care fraud, which result in convictions, monetary recoveries, and exclusions of providers and 
suppliers from Federal health care programs; 

> Office of Audit Services : conducts and oversees audits of Medicare and Medicaid payments 
and operations, identifies improper payments and program vulnerabilities, and recommends 
audit disallowances and program improvements; 

> Office of Evaluation and Inspections : conducts evaluations of the Medicare and Medicaid 
programs to identify program integrity vulnerabilities and make recommendations to prevent 
fraud, waste, and abuse and to promote economy, efficiency, and effectiveness; and 

> Office of Counsel to the Inspector General : represents OIG in all civil and administrative 
fraud cases and, in connection with these cases, negotiates and monitors corporate integrity 
agreements; provides guidance to the health care industry to promote compliance; and 
provides legal support to OIG operations. 

OIG 's program integrity activities are a sound investment. 

In FY 2009, OIG investigations resulted in $4 billion in settlements and court-ordered fines, 
penalties, and restitution, and in 671 criminal actions. OIG audits resulted in almost $500 
million in receivables through recommended disallowances. We also produced equally 
important but less quantifiable gains in deterrence and prevention of fraud, waste, and abuse. 
OIG has recommended numerous actions to address program integrity vulnerabilities. For 
example, we found that Medicare’s average spending per beneficiary for inhalation drugs was 
five times higher in South Florida, an area rife with Medicare fraud, than in the rest of the 
country, and that a disproportionately high rate of these claims in South Florida exceeded the 
maximum dosage guidelines. OIG’s recommendations included adding new claims edits to 
prevent fraudulent or excessive payments, including edits to detect dosages exceeding coverage 
guidelines. Many other recommendations to prevent and deter fraud, waste, and abuse are 
described in our annual Compendium of Unimplemented OIG Recommendations, the latest 
edition of which will be published later this month. 

OIG Work Highlighting the Nature and Scope of Health Care Fraud, Waste, and Abuse 

Fraud is a serious problem requiring a serious response. 

Although there is no precise measure of health care fraud, we know that it is a serious problem 
that demands an aggressive response. We must not lose sight of the fact that the vast majority of 
health eare providers are honest and well-intentioned; nonetheless, a small minority of providers 
intent on abusing the system can cost billions of dollars. We believe that the $4 billion in 
settlements and court-ordered returns in FY 2009 resulting from OIG fraud investigations is just 
the tip of the iceberg. More disturbing, even if the rate of fraud remains constant, as health eare 
expenditures continue to rise, the financial impact of health care fraud will continue to increase. 

OIG investigations uncover a range of fraudulent activity. Health care fraud schemes commonly 
include billing for services that were not provided or were not medically necessary, billing for a 
higher level of service than what was provided (“upending”), misreporting costs or other data to 
increase payments, paying kickbacks, and/or stealing providers’ or beneficiaries’ identities. The 
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perpetrators of these schemes range from street criminals, who believe it is safer and more 
profitable to steal from Medicare than trafficking in illegal drugs, to Fortune 500 companies that 
pay kickbacks to physicians in return for referrals. 

Many OIG investigations target fraud committed by criminals who masquerade as Medicare 
providers and suppliers but who do not provide legitimate services or products. The rampant 
fraud among durable medical equipment (DME) suppliers in South Florida is a prime example. 

In these cases, our investigations have found that criminals set up sham DME storefronts to 
appear to be legitimate providers, fraudulently bill Medicare for millions of dollars, and then 
close up shop and reopen in a new location under a new name and repeat the fraud. The 
criminals often pay kickbacks to physicians, nurses and even patients to recruit them as 
participants in the fraud scheme. 

The Medicare program is increasingly infiltrated by violent criminals, and our investigations are 
also finding an increase in sophisticated and organized criminal networks. Some of these fraud 
schemes are viral, i.e., schemes are replicated rapidly within geographic and ethnic communities. 
Health care fraud also migrates - as law enforcement cracks down on a particular scheme, the 
criminals may shift the scheme (e.g,, suppliers fraudulently billing for DME have shifted to 
fraudulent billing for home health services) or relocate to a new geographic area. To combat this 
fraud, the Government’s response must also be swift, agile, and organized. 

Health care fraud is not limited to this blatant fraud among sham providers. Major corporations 
such as pharmaceutical and medical device manufacturers and institutions such as hospitals and 
nursing facilities have also committed fraud, sometimes on a grand scale. OIG has a strong 
record of investigating these corporate and institutional frauds, which often involve complex 
billing frauds, kickbacks, accounting schemes, illegal marketing, and physician self-referral 
arrangements. In addition, we are seeing an increase in quality of care cases involving 
allegations of substandard care. 

Wasle and abuse cost taxpayers billions of dollars and must be addressed. 

Waste of funds and abuse of the health care programs also cost taxpayers billions of dollars. In 
FY 2009, CMS estimated that overall, 7.8 percent of the Medicare fee-for-service claims it paid 
($24.1 billion) did not meet program requirements. Although these improper payments do not 
necessarily involve fraud, the claims should not have been paid. For our part, OIG reviews 
specific services, based on our assessments of risk, to identify improper payments. For example, 
an OIG audit uncovered $275.3 million in improper Medicaid payments (Federal share) from 
2004 to 2006 for personal care services in New York City alone. An OIG evaluation of 
payments for facet joint injections (a pain management treatment) found that 63 percent of these 
services allowed by Medicare in 2006 did not meet program requirements, resulting in $96 
million in improper payments. 

OIG’s work has also repeatedly demonstrated that Medicare and Medicaid pay too much for 
certain services and products and that aligning payments with costs could produce substantial 
savings. For example, OIG reported that Mediceire reimbursed suppliers for pumps used to treat 
pressure ulcers and wounds based on a purchase price of more than $17,000, but that suppliers 
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paid, on average, approximately $3,600 for new models of these pumps. Likewise, in 2006, 
Medicare allowed approximately $7,200 in rental payments over 36 months for an oxygen 
concentrator that cost approximately $600 to purchase. Beneficiary coinsurance alone for 
renting an oxygen concentrator for 36 months exceeded $1,400 (more than double the purchase 
price). 

OIG’s Strategy and Recommendations for Combating Fraud, Waste, and Abuse 

Combating health care fraud requires a comprehensive strategy of prevention, detection, and 
enforcement. OIG has been engaged in the fight against health care fraud, waste, and abuse for 
more than 30 years. Based on this experience and our extensive body of work, we have 
developed five principles of an effective health care integrity strategy. OIG uses these principles 
in our strategic work planning to assist in focusing our audit, evaluation, investigative, 
enforcement, and compliance efforts most effectively. 

1. Enrollment : Scrutinize individuals and entities that -want to participate as providers and 
suppliers prior to their enrollment in the health care programs. 

The first step in preventing health care fraud and abuse is to stop those who would defraud or 
abuse the programs from gaining entry to them. The concept is simple but the execution can be 
challenging. The Medicare program was designed to make it easy to enroll as a provider to 
encourage participation and ensure beneficiary access to services. However, this also makes it 
too easy for sham providers and suppliers to obtain Medicare billing numbers and bill for 
millions of dollars in fraudulent claims. 

In 2006 and 2007, OIG conducted unannounced site visits to almost 2,500 Medicare DME 
suppliers in South Florida and Los Angeles and found that almost 600 of these suppliers (about 
24 percent) did not maintain a physical facility or were not open and staffed during business 
hours, as required. OIG has recommended heightened enrollment screening and oversight for 
high-risk items and services. CMS has taken some important steps toward this end, particularly 
for DME providers in South Florida. Additional scrutiny for high risk areas through 
unannounced site visits, background checks, enhanced claims screening for new enrollees, and 
enhanced authorities (such as explicit authority to impose temporary enrollment moratoriums) 
could further discourage this type of fraud. OIG will continue to monitor the effectiveness of 
provider enrollment safeguards. 

2. Payment : Establish payment methodologies that are reasonable and responsive to changes in 
the marketplace and medical practice. 

Establishing reasonable and responsive payment methodologies prevents the type of waste, 
described above, that results when payment methodologies are misaligned with costs and market 
prices. OIG has identified these misalignments for various health care services and products, and 
we have recommended fixes. For example, capping rental of oxygen concentrators at 13 months 
instead of 36 months would save Medicare billions of dollars. 


House Appropriations Committee 

Subcommittee on Labor, Health and Human Services, Education, and Related Agencies 
March 4, 2010 


Page 4 of 10 



172 


Applying this principle can also deter fraud. For example, an OIG evaluation found that in 2007, 
Medicare allowed, on average, about S4,000 for standard power wheelchairs that cost suppliers, 
on average, about $1,000 to acquire. Profit margins like these attract fraud. OIG has 
investigated numerous cases of fraudulent billing for power wheelchairs, and in some of these 
cases, the suppliers actually provide wheelchairs to beneficiaries who do not need them because 
the reimbursement - even after purchasing the wheelchair - is high enough to make this scam 
lucrative. CMS has the authority to make certain adjustments to payments for DME and other 
items or services, but for some changes (such as reducing the rental period for oxygen 
concentrators), legislative changes are needed. 

3. Compliance : Assist health care providers and suppliers in adopting practices that promote 
compliance with program requirements. 

The vast majority of health care providers and suppliers are honest and well-intentioned. They 
are valuable partners in ensuring the integrity of Federal health care programs. OIG seeks to 
collaborate with health care industry stakeholders to foster voluntary compliance efforts. 

Toward this end, OIG has produced extensive resources (available on our Web site at 
http://oig.hhs.govI to assist industry stakeholders in understanding the fraud and abuse laws and 
designing and implementing effective compliance programs. These resources include sector- 
specific Compliance Program Guidance documents that describe the elements of effective 
compliance programs and identify risk areas, advisory opinions, and fraud alerts and bulletins. 
We have a self-disclosure program that encourages providers to self-report fraud uncovered 
within their company and to work with OIG to resolve the problem fairly and efficiently. 
Effective compliance programs help make honest providers our partners in the fight against 
health care fraud. OIG recommends that providers and suppliers should be required to adopt 
compliance programs as a condition of participating in the Medicare and Medicaid programs. 

4. Oversieht : Vigilantly monitor the programs for evidence of fraud, waste, and abuses 

Rapid detection of fraud, waste, and abuse is essential to ensuring the integrity of health care 
dollars. This includes using data and technology to detect potential problems as claims are 
submitted and before they are paid. It also includes conducting advanced data analysis to 
identify, track, and monitor patterns of fraud to target enforcement efforts. With appropriate 
protections, identifying effective ways to share information across Federal and State agencies 
and with private insurers can leverage resources and improve our collective effectiveness in 
fighting fraud, waste, and abuse. Through HEAT, progress has been made in improving law 
enforcement’s access to Medicare data, sharing information and intelligence, and conducting 
data analysis to prioritize and target our fraud-fighting efforts. 

5. Response : Respond swiftly to detected fraud, impose sufficient punishment to deter others, 
and promptly remedy program vulnerabilities. 

Although it is ideal to prevent payments for fraudulent or improper claims, there will never be 
perfect prevention. An effective anti-fraud strategy must incorporate a strong enforcement 
component. Criminals balance the risk of detection and punishment against the benefits of the 
crime and have concluded that Medicare and Medicaid fraud are a good bet. It is imperative that 
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we change the calculation by increasing the risk of prompt detection and the certainty of 
punishment. 

As part of this strategy, OIG is working closely with its partners in DOJ and in the States to 
accelerate and maximize the effectiveness of our law enforcement response to fraud. Medicare 
Fraud Strike Forces represent one very successful enforcement model. In addition, OIG 
investigates and DOJ prosecutes civil cases that return billions of dollars to the Medicare and 
Medicaid programs. OIG is also using our administrative authorities to hold responsible 
individuals accountable for fraud, including physicians who accept kickbacks and responsible 
corporate officials whose companies have committed fraud. 

CMS and States must also respond swiftly to recoup misspent funds, take appropriate 
administrative actions (e.g., revoking billing privileges, suspending payments), and remedy 
program vulnerabilities. Through the HEAT initiative, described in more detail below, the 
Government is significantly accelerating and strengthening its response to fraud, waste, and 
abuse. 

Resources and Tools for Health Care Oversight and Enforcement Activities 

Adequate funding of the Health Care Fraud and Abuse Control (HCF AC) Program is vital to the 
fight against fraud, waste, and abuse. 

The Health Care Fraud and Abuse Control (HCFAC) Program is a comprehensive program under 
the joint direction of the Attorney General and the Secretary of HHS, acting through our OIG, 
designed to coordinate Federal, state and local law enforcement activities with respect to health care 
fraud and abuse. The HCFAC Program draws funds from the Medicare Trust Fund to finance 
anti-fraud activities. Certain of these sums are to be used only for activities of OIG, with respect to 
the Medicare and Medicaid programs. The HCFAC Program is OIG’s primary funding stream, 
and accounts for 73 percent of our FY 2010 appropriation. 

From its inception in 1997 through 2008, HCFAC Program activities returned more than 
$13.1 billion to the Federal Government. The HCFAC retum-on-investment is $6 for every $1 
invested in OIG, DOJ, and HHS activities through the HCFAC Account.^ This retum-on- 
investment calculation includes only actual recoveries, such as dollars returned to the Federal 
Government and redeposited in the Medicare Tmst Fund, the Treasury or returned to other 
Federal “victim” agencies. Savings realized from implementation of OIG’s recommendations to 
promote economy, efficiency, and effectiveness of Medicare and Medicaid operations create 
additional returns from OIG operations, but these are not captured in HCFAC return-on- 
investment calculations. 

Thanks to this Subcommittee’s support for investing in HCFAC activities, OIG’s total HCFAC 
appropriation for FY 2010 is $207 million, which includes $177 million in mandatory funds and 
almost $30 million in discretionary funding. OIG is directing these resources to conduct 


^ The $6 to $1 return on investment is a 3-year rolling average from 2006-2008, which is used to help account for 
the natural fluctuation in returns from investigative, enforcement, and audit activities. 
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Medicare and Medicaid investigations, audits, evaluations, enforcement, and compliance 
activities to support our health care program integrity strategy described above. Examples of our 
HCF AC-funded activities include: 

> Establishment of Strike Force teams in seven cities; 

> Support of Civil False Claims Act investigations and enforcement; 

> Support of administrative enforcement activities; 

> Evaluations of Medicare contractor operations, services provided to nursing home residents. 
Medicare and Medicaid reimbursement for prescription drugs, and other issues; 

> Audits of payments to hospitals, home health agencies. Medicare Advantage plans, and 
Medicare Part D plans, among other providers; 

> Monitoring of providers under corporate integrity agreements; and 

> Issuance of advisory opinions and other guidance to the health care industry. 

In addition to the $30 million in discretionary HCFAC funds in FY 2010 (which will continue 
into FY 2011), the President’s FY 201 1 Budget proposes an additional $65 million increase in 
FICFAC discretionary funding. This represents a net increase of $40 million in total funding for 
OlG’s health care integrity activities. 

The proposed $65 million increase in FICFAC discretionary funding includes $25 million to 
continue funding OIG’s oversight and enforcement activities that were previously funded 
through the Deficit Reduction Act of 2005 (DRA). The DRA provided $25 million each year in 
FYs 2006-2010 to fund OIG’s Medicaid integrity activities. In recognition of the continued need 
for OIG oversight and enforcement beyond FY 2010, the Administration included $25 million in 
its request for FY 201 1 for OIG to sustain health care oversight activities. The proposed budget 
would enable us to continue ffaud-fighting efforts that would otherwise necessarily dwindle as 
the DRA funding ceased. Further, providing these funds under HCFAC provides the advantages 
of consolidating funding streams with similar purposes and expanding the authorized use of 
these funds to include Medicare oversight as well as Medicaid oversight. Medicare and 
Medicaid program integrity activities are often related. For example, many of our investigations 
involve an individual or entity committing fraud against both programs. 

The proposed $65 million HCFAC increase also includes $40 million in new funding for OIG’s 
activities in support of the HEAT initiative, including establishing Strike Force teams in 13 new 
locations. We estimate that almost $25 million of this funding would be needed to support the 
Strike Force expansions and the remaining $15 million would support OIG’s other HEAT 
activities, including audits, evaluations, civil and administrative enforcement, and compliance 
activities. 

Through HEAT, OIG is enhancing the impact of our prevention, detection, and enforcement 
efforts. 

OIG is a key member of HEAT; indeed, HEAT’S fraud and abuse prevention, detection, and 
enforcement activities are our primary focus and core mission. The collaboration brought about 
by HCFAC and enhanced by HEAT has improved coordination and communication, which has 
in turn led to greater impact and effectiveness of our collective fraud-fighting efforts. 
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Prevention . Prevention of health care fraud, waste, and abuse was written into the legislation 
that created OIG - it is integral to our mission and activities. OIG makes recommendations to 
the Centers for Medicare & Medicaid Services (CMS) to remedy program vulnerabilities that we 
uncover through our evaluations and audits. OIG also provides CMS with intelligence gleaned 
from our investigations and data analysis to help CMS target its prevention efforts effectively. In 
addition, OIG’s guidance and outreach to the health care industry help the well-intended health 
care providers avoid fraudulent or abusive conduct and promote compliance with program 
requirements. Further, our enforcement activities prevent fraud by stopping ongoing schemes 
and deterring future fraud. 

HEAT has strengthened these prevention efforts. It has provided a forum for advancing OIG’s 
recommendations to remedy program vulnerabilities in Medicare and Medicaid. For example, 
senior staff from OIG and CMS are working together to plan actions that CMS can take in the 
short term to address some of OIG’s outstanding recommendations. In addition, HEAT has 
increased interagency communication about fraud trends, new initiatives, and ideas through the 
creation of committees and work groups comprised of experts from across HHS and DOJ who 
meet regularly to collaborate and develop new strategies for preventing fraud, waste, and abuse. 
Also, in conjunction with HEAT, OIG is considering further outreach opportunities to engage 
health care providers in fraud prevention. 

Detection . In support of HEAT, OIG has developed and leads a data analysis team, which 
includes DOJ and CMS, to identify fraud patterns and trends and strategically target all of our 
resources. This data analysis team identified geographic concentrations of fraud to help 
determine in what cities to establish new Strike Force teams and analyzes fraud indicators to 
provide specific investigative leads to Strike Force teams. 

Collaborating with our partners through HEAT has also resulted in improved data access for law 
enforcement. Access to “real-time” claims data - that is, as soon as the claim is submitted to 
Medicare - is critical to identifying fraud as it is being committed. With “real time” knowledge, 
we would be better able to stop the fraud more quickly and to bring the perpetrator to Justice and 
recoup the stolen funds before the criminal or the money disappears. Timely data is also 
essential to our agile response as criminals shift their schemes and locations to avoid detection. 
Although we do not yet have access to comprehensive real-time claims data, we have made 
important strides in obtaining data more quickly and efficiently. On a pilot basis, CMS recently 
provided several OIG investigators and analysts access to a Medicare data system that includes 
much of the real-time claims data that law enforcement needs. OIG, DOJ, and CMS have also 
worked together to develop a data request template so that CMS contractors can process our data 
requests faster and with more efficiency. 

Enforcement . OIG and DOJ jointly lead the Medicare Fraud Strike Force teams, which have 
expanded through HEAT from two to seven locations. The successes of these Strike Forces are 
described in detail below. In addition, HEAT has also led OIG and DOJ to jointly reassess our 
resource allocation for our civil fraud cases, which have yielded billions of dollars in returns, to 
ensure that we are prioritizing these resources most effectively. 
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Medicare Fraud Strike Forces have proven to be successful infighting health care fraud. 

The Strike Forces are an essential component of HEAT and have achieved impressive 
enforcement results. Collectively, Strike Forces have resulted in approximately 270 convictions, 
indictments of more than 500 defendants, and more than $240 million in court-ordered 
restitutions, fines, and penalties. Strike Forces also deter fraud. For example, during the first 
year of Strike Force operations in Miami, which focused on DME fraud, submissions of DME 
claims decreased by 63 percent, representing a decrease of $1.75 billion, compared to the 
previous year. The Strike Force model is especially effective for investigating and prosecuting 
health care fraud cases involving sham Medicare providers and suppliers masquerading as 
legitimate health care providers and suppliers. 

Strike Forces are designed to identify, investigate, and prosecute fraud quickly. Strike Force 
teams are comprised of dedicated DOJ prosecutors and Special Agents from OIG, the Federal 
Bureau of Investigations, and, in some cases. State and local law enforcement agencies. These 
“on the ground” enforcement teams are supported by the data analysis team (described above) 
and by CMS program experts and contractors. This coordination and collaboration has 
accelerated the Government’s response to criminal fraud, decreasing by roughly half the average 
time from an investigation’s start to the case’s prosecution. 

Under HEAT, Strike Forces have expanded from two locations (Miami and Los Angeles) to 
seven. In May 2009, new Strike Forces were announced in Houston and Detroit. In December 
2009, Strike Forces teams became operational in Brooklyn, Tampa, and Baton Rouge. 

The President’s FY 201 1 Budget proposal would expand Strike Forces to 13 new locations, 
bringing the total number of Strike Force locations to 20. The selection of Strike Force locations 
is based on data analysis of Medicare claims to determine fraud hot spots. 

OIG estimates that it will require almost $25 million to establish and operate Strike Forces in 13 
new locations. This funding would support an estimated 130 full-time employees dedicated to 
Strike Force operations and support. These 130 employees would primarily be comprised of 
investigative staff, including criminal investigators, supervisory investigators, computer forensic 
specialists, and investigative operations trainers. Additional staff supporting the new Strike 
Forces would include auditors, evaluators, data analysts, attorneys, and administrative and 
information technology (ITT staff. 

With this funding, OIG is committed to working with our DOJ partners to establish Strike Forces 
in 13 new locations. We anticipate that it will take us through 2012 to fully launch Strike Force 
teams in all 13 cities, consistent with the two-year time frame for which the money would be 
available under the President’s proposal. However, immediately upon receiving the funding, we 
will begin hiring and training staff and conducting the other preparatory work, such as leasing 
additional space and purchasing IT and other equipment, necessary to launch and support the 
new Strike Force teams. 
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Conclusion 

Health care fraud, waste, and abuse are serious problems that cost taxpayers billions of dollars 
every year and require focused attention and commitment to solutions. Protecting Medicare and 
Medicaid beneficiaries and taxpayer dollars is integral to OIG’s mission. Through the dedicated 
efforts of my staff and our collaboration with HHS and DOJ, we have achieved substantial 
results in the form of recoveries of stolen and misspent funds; enforcement actions taken against 
fraud perpetrators; improved methods of detecting fraud and abuse; and solutions to address 
program vulnerabilities and prevent fraud, waste, and abuse from occurring. Working together, 
we are maximizing our collective effectiveness and success in this endeavor. Health care fraud, 
waste, and abuse are long-standing problems that require sustained commitment to combat them. 
On behalf of OIG, I make that commitment to you. Thank you for your attention to and support 
for this mission. I welcome your questions. 


House Appropriations Committee 

Subcommittee on Labor, Health and Human Services, Education, and Related Agencies 
March 4, 2010 


Page lOoflO 



178 


News Release 


FOR IMMEDIATE RELEASE Contact: HHS Press Office 

Thursday, February 17, 2011 (202) 690-6343 


Medicare Fraud Strike Force Charges 111 Individuais for more than 
$225 Miiiion in False Billing and Expands Operations to Two Additional 

Cities 

DoctorSf NurseSf Health Care Company Owners and Executives Among the Defendants 
Charged; Law Enforcement Agents Execute 16 Sear^ Warrants 

WASHINGTON - The Medicare Fraud Strike Force today charged 111 defendants in nine cities, 
including doctors, nurses, health care company owners and executives, and others, for their alleged 
participation in Medicare fraud schemes involving more than $225 million in false billing, announced 
Attorney General Eric Holder, Health and Human Services (HHS) Secretary Kathleen Sebelius, FBI 
Executive Assistant Director Shawn Henry, Assistant Attorney General Lanny A. Breuer of the Criminal 
Division and HHS Inspector General Daniel Levinson. Also today, the Department of Justice (DOJ) and 
HHS announced the expansion of Medicare Fraud Strike Force operations to two additional cities - 
Dallas and Chicago. Today's operation is the largest-ever federal health care fraud takedown. 

The joint DOJ-HHS Medicare Fraud Strike Force is a multi-agency team of federal, state, and local 
investigators designed to combat Medicare fraud through the use of Medicare data analysis techniques 
and an increased focus on community policing. More than 700 law enforcement agents from the FBI, 
HHS-Office of Inspector General (HHS-OIG), multiple Medicaid Fraud Control Units, and other state 
and local law enforcement agencies participated in today's operation. In addition to making arrests, 
agents also executed 16 search warrants across the country In connection with ongoing strike force 

investigations. 

"With this takedown, we have identified and shut down large-scale fraud schemes operating 
throughout the country. We have safeguarded precious taxpayer dollars. And we have helped to 
protect our nation's most essential health care programs. Medicare and Medicaid," said Attorney 
Genera! Holder. "As today's arrest prove, we are waging an aggressive fight against health care 

fraud." 

"Over the last two years our joint efforts have more than quadrupled the number of anti-fraud Strike 
Force teams operating in fraud hot spots around the country from two to nine - with the latest 
additions Chicago and Dallas — bringing hundreds of charges against criminals who had billed 
Medicare for hundreds of millions of dollars. Last year alone, our partnership recovered a record $4 
billion on behalf of taxpayers. From 2008-2010, every dollar the Federal Government spent under its 
Health Care Fraud and Abuse Control programs averaged a return on investment of $6.80," said HHS 

Secretary Sebelius. 

The defendants charged today are accused of various health care fraud-related crimes, including 
conspiracy to defraud the Medicare program, criminal false claims, violations of the anti-kickback 
statutes, money laundering and aggravated identity theft. The charges are based on a variety of 
alleged fraud schemes involving various medical treatments and services such as home health care, 
physical and occupational therapy, nerve conduction tests and durable medical equipment. 

According to court documents, the defendants charged today participated in schemes to submit claims 
to Medicare for treatments that were medically unnecessary and oftentimes, never provided. In many 
cases, indictments and complaints allege that patient recruiters, Medicare beneficiaries and other co- 
conspirators were paid cash kickbacks in return for supplying beneficiary information to providers, so 
that the providers could submit fraudulent billing to Medicare for services that were medically 
unnecessary or never provided. Collectively, the doctors, nurses, health care company owners, 
executives and others charged in the indictments and complaints are accused of conspiring to submit 
a total of more than $225 million In fraudulent billing. 


http://www.hhs.gov/news/press/2011pres/02/20110217a.html 



179 


Medicare Fraud Strike Force Charges 111 individuals for more than $225 Million in False Billing and Expands 
Operations to Two Additional Cities 


"Every American bears the burden of health care fraud, and the FBI, in conjunction with our Inter- 
agency partners, will continue to dismantle criminal networks that bilk the system," said Shawn 
Henry, Executive Assistant Director of the FBI's Criminal, Cyber, Response and Services Branch. "Our 
agents and analysts use task forces and undercover operations to identify individuals who treat the 
health care system as a vehicle to line their pockets." 

"Today, Strike Force operations have charged doctors, nurses, health care executives, and others - 
from Los Angeles to New York and cities in between - with engaging in Medicare fraud schemes that 
cheat taxpayers and patients alike," said Assistant Attorney General Breuer. "With this nationwide 
takedown and the expansion of the Strike Force to two additional cities, our message is clear: we are 
determined to put Medicare fraudsters out of business." 

"Today, more than 300 special agents from OIG, In partnership with federal and state agencies across 
the country, are making more than a hundred arrests on charges of health care fraud," said Daniel R. 
Levinson, HHS Inspector General. "These unprecedented operations send a clear message - we will 
not tolerate criminals lining their pockets at the expense of Medicare patients and taxpayers." 

In Miami, 32 defendants, including 2 doctors and 8 nurses, were charged for their participation in 
various fraud schemes involving a total of $55 million in false billings for home health care, durable 
medical equipment and prescription drugs. Twenty-one defendants. Including three doctors, three 
physical therapists and one occupational therapist, were charged in Detroit for schemes to defraud 
Medicare of more than $23 million. The Detroit cases involve false claims for home health care, nerve 
conduction tests, psychotherapy, physical therapy and podiatry. 

In Brooklyn, N.Y., 10 individuals, including three doctors and one physical therapist, were charged 
with fraud schemes involving $90 million In false billings for physical therapy, proctology services and 
nerve conduction tests. Ten defendants were charged In Tampa for participating in schemes Involving 
more than $5 million related to false claims for physical therapy, durable medical equipment and 

pharmaceuticals. 

Nine Individuals were charged in Houston for schemes involving $8 million in fraudulent Medicare 
claims for physical therapy, durable medical equipment, home health care and chiropractor services. 
In Dallas, seven defendants were indicted for conspiring to submit $2.8 million in false billing to 
Medicare related to durable medical equipment and home health care. 

Five defendants were charged in Los Angeles for their roles in schemes to defraud Medicare of more 
than $28 million. The cases In Los Angeles involve false claims for durable medical equipment and 
home health care. In Baton Rouge, La., six individuals were charged for a durable medical equipment 
fraud scheme involving more than $9 million in false claims. 

In Chicago, charges were filed against 11 Individuals associated with businesses that have billed 
Medicare more than $6 million for home health, diagnostic testing and prescription drugs. 

The Medicare Fraud Strike Force operations are part of the Health Care Fraud Prevention & 
Enforcement Action Team (HEAT), a joint initiative announced in May 2009 between the Department 
of Justice and HHS to focus their efforts to prevent and deter fraud and enforce current anti-fraud laws 

around the country. 

Since their inception in March 2007, Strike Force operations in nine districts have charged more than 
990 individuals who collectively have falsely billed the Medicare program for more than $2.3 billion. 

In addition, the HHS Centers for Medicare and Medicaid Services, working in conjunction with the 
HHS-OIG, are taking steps to increase accountability and decrease the presence of fraudulent 

providers. 

The cases announced today are being prosecuted and investigated by Strike Force teams comprised of 
attorneys from the Fraud Section In the Justice Department's Criminal Division and from the U.S. 
Attorney's Offices for the Southern District of Florida, the Eastern District of Michigan, the Eastern 
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District of New York, the Middle District of Florida, the Southern District of Texas, the Centra! District 
of California, the Middle District of Louisiana; the Northern District of Illinois, and the Northern District 
of Texas; and agents from the FBI, HHS-OIG, and state Medicaid Fraud Control Units. 

An indictment is merely a charge and defendants are presumed innocent until proven guilty. 

To learn more about the Health Care Fraud Prevention and Enforcement Action Team (HEAT), go to; 

www.stopmedicarefraud.aov . 
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IMPROPER PAYMENTS 

Progress Made but Challenges Remain in Estimating 
and Reducing Improper Payments 


What GAO Found 

Agencies reported improper payment estimates of $72 billion for fiscal year 2(XI8, 
which represented about 4 percent of the $1.8 trillion of reported outlays for the 
related programs. This represents a significant increase from the fiscal year 2007 
estimate attiibutable to (1) a $12 billion increase in the Medicaid program’s 
estimate and (2) 10 newly reported programs with improper payment estimates 
totaling about $10 billion. 

• Progress made in estimating and reducing improper payments. 

The govemmentwide improper payment estimates rose about $23 billion from 
fiscal year 2007 to 2008. This represents a positive step to improve 
transparency over the full magnitude of the federal government's improper 
payments. Further, of the 35 agency programs reporting improper payment 
estimated error rates for each of the 5 fiscal years since implementation of 
IPIA — 2004 through 2008—24 programs (or about 69 percent) reported 
reduced error rates when comparing fiscal year 2008 error rates to fiscal year 
2004 error rates. Also, the number of programs with error rate reductions 
totaled 35 when comparing fiscal year 2008 error rates to fiscal year 2007 
rates. 

• Challenges remain in meeting the goals of IPIA governmentwide. 

The total improper payment estimate does not yet reflect the full scope of 
improper payments across executive branch agencies; noncompliance issues 
with IPIA continue; and agencies continue to face ch^enges in the design or 
implementation of internal controls critical to identifying and preventing 
improper p^rments. The fiscal year 2008 total improper payment estimate of 
$72 billion reported for fiscal year 2008 did not include any estimate for ten 
programs — including the Medicare Prescription Drug Benefit program— with 
fiscal year 2008 outlays totaling about $61 billion that were identified as 
susceptible to significant Improper payments. Over half of the agencies’ OIGs 
identified mans^ement or performance challenges that could increase the risk 
of improper payments, including challenges related to effective internal 
controls. 

• Medicare and Medicaid programs’ implementatjon of IPIA and its 
challenges. Medicare and Medicaid comprise 50 percent of reported 
govemmentwide improper payments in fiscal year 2008. HHS reported 
improper payment amounts of $10.4 billion in Medicare Fee-for-Service and 
$6.8 billion in Medicare Advantage. HHS also reported in its agency financial 
report that it issued its first full-year Medicaid improper payment rate 
estimate of 10-5 percent, or $18.6 billion for the federal share of expenditures 
for fiscal year 2008. This Medicaid improper payment estimate represents the 
largest amount that any federal agency reported for a program in fiscal year 
2008. While CMS has taken steps to enhance its program integrity efforte, 
further work remains to put in place the internal controls necessary to 
effectively identify and detect improper payments. For example, GAO’s work 
on Medicare's home health care administration and enrollment of durable 
medical equipment suppliers found weaknesses that exposed the program to 
significant improper payments. The m^nitude of Medicaid improper 
payments indicates that CMS and the states face significant challenges in 
addressing the program's vulnerabilities in estimating national improper 
payment rates for diverse state-administered programs. 
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DEPARTMENT OF HEALTH AND 
HUMAN SERVICES 

Centers for Medicare & Medicaid 
Services 

42 CFR Parts 405, 424, 447, 455, 4S7, 
and 498 

Office of inspector General 

42 CFR Part 1007 
[CMS-6D28-FC] 

RIN 0938-AQ20 

Medicare, Medicaid, and Children’s 
Health Insurance Programs; Additional 
Screening Requirements, Application 
Fees, Temporary Enrollment Moratoria, 
Payment Suspensions and Compliance 
Plans for Providers and Suppliers 

AGENCY: Centers for Medicare & 
Medicaid Services (CMS); Office of 
Inspector General (OIG), HHS, 
action: Final rule with comment period. 

SUMMARY: This final rule with comment 
period will implement provisions of the 
ACA that establish: Procedures under 
which screening is conducted for 
providers of medical or other services 
and suppliers in the Medicare program, 
providers in the Medicaid program, and 
providers in the Children’s Health 
insurance Program (CHIP); an 
application fee imposed on institutional 
providers and suppliers; temporary 
moratoria that may be imposed if 
necessary to prevent or combat baud, 
waste, and abuse under the Medicare 
and Medicaid programs, and CHIP; 
guidance for States regarding 
termination of providers from Medicaid 
and CHIP if terminated by Medicare or 
another Medicaid State plan or CHIP; 
guidance regarding the termination of 
providers and suppliers from Medicare 
if terminated by a Medicaid State 
agency; and requirements for 
suspension of payments pending 
credible allegations of fraud in the 
Medicare and Medicaid programs. This 
final rule with comment period also 
discusses our earlier solicitation of 
comments regarding provisions of the 
ACA that require providers of medical 
or other items or services or suppliers 
within a particular industry sector or 
category to establish compliance 
programs. 

We have identified specific provisions 
surrounding our implementation of 
fingerprinting for certain providers and 
suppliers for which we may make 
changes if warranted by the public 
comments received. We expect to 
publish our response to those 


comments, including any possible 
changes to the rule made as a result of 
them, as soon as possible following the 
end of the comment period. 

Furthermore, we clarify that we are 
finalizing the adoption of fingerprinting 
pursuant to the terms and conditions set 
forth herein. 

DATES: Effective date; These regulations 
are effective on March 25, 2011. 
Comment date: We will consider public 
comments only on the Fingerprinting 
Requirements, contained in §§424.518 
and 455.434 and discussed in section 
II. A.5. of the preamble of this document, 
if we receive them at one of the 
addresses provided below, no later than 

5 p.m. on April 4. 2011. 

ADDRESSES; In commenting, please refer 
to file code CMS-6028— FC. Because of 
staff and resource limitations, we cannot 
accept comments by facsimile (FAX) 
transmission. 

You may submit comments in one of 
four ways (please choose only one of the 
ways listed): 

1. BJectronicaliy. You may submit 
electronic comments on this regulation 
to bttp'J/www.reguhtions.gov. Follow 
the instructions for “submitting a 
cammenl.” 

2. By regular mail. You may mail 
written comments to the following 
address ONLY: Centers for Medicare & 
Medicaid Services, Department of 
Health and Human Services, Attention: 
CMS-6028-FC, P.O. Box 8013. 
Baltimore, MD 21244-8013. 

Please allow sufficient time for mailed 
comments to be received before the 
close of the comment period. 

3. By express or overnight moil. You 
may send written comments to the 
following address ONLY: Centers for 
Medicare & Medicaid Services. 
Department of Health and Human 
Services, Attention: CMS-6028-FC. 

Mail Stop C4-26-05, 7500 Security 
Boulevard, Baltimore, MD 21244-1850. 

4. By bond or courier. If you prefer, 
you may deliver (by hand or courier) 
your written comments before the close 
of the comment period to either of the 
following addresses; a. For delivery in 
Washington. DC — Centers for Medicare 

6 Medicaid Services, Department of 
Health and Human Services, Room 445- 
G, Hubert H. Humphrey Building, 200 
Independence Avenue, SW,, 
Washington, DC 20201. 

(Because access to the interior of the 
Hubert H. Humphrey Building is not 
readily available to persons without 
Federal government identification, 
commenters are encouraged to leave 
their comments in the CMS drop slots 
located in (he main lobby of the 
building. A stamp-in clock is available 


for persons wishing to retain a proof of 
filing by stamping in and retaining an 
extra copy of the comments being filed.) 

b. For delivery in Baltimore, MD — 
Centers for Medicare & Medicaid 
Services, Department of Health and 
Human Services, 7500 Security 
Boulevard, Baltimore, MD 21244-1850. 

If you intend to deliver your 
comments to the Baltimore address, 
please call telephone number (410) 786- 
9994 in advance to schedule your 
arrival with one of our staff members. 

Comments mailed to the addresses 
indicated as appropriate for hand or 
courier delivery may be delayed and 
received after the comment period. 

FOR FURTHER (NFORMATION CONTACT: 
Frank Whelan (410) 786-1302 for 
Medicare enrollment issues. Claudia 
Simonson (312) 353-2115 for Medicaid 
and CHIP enrollment issues. Lori Bellan 
(410) 786-2048 for Medicaid payment 
suspension issues and Medicaid 
termination issues. Joseph Strazzire 
(410) 786-2775 for Medicare payment 
suspension issues. Laura Minassian- 
Kiefel (410) 786-4641 for compliance 
program issues. 

SUPPLEMENTARY INFORMATION: Due to the 
many organizations and terms to which 
we refer by acronym in this final rule 
with comment period, we are listing 
these acronyms and their corresponding 
terms in alphabetical order below. In 
addition, we are providing a table of 
contents which follows the list of 
acronyms to assist readers in referencing 
sections contained in this preamble. 

Acronyms 

ABC American Board for Certification in 
Orthotics and Prosthetics 
A/B MAC Part A or Part B Medicare 
Administrative Contractor 
ACA ‘'Affordable Care Act" 

APD Advance planning document 
ASC Ambulatory surgical center . 

BBA Balanced Budget Act of 1997 (Pub. L. 
105-33) 

BIPA Medicare Medicaid, and SCHIP 
Benefits Improvement Protection Act of 
2000 (Pub. L, 106-544) 

CAH Critical acce.'i.'! hospital 
Cap Competitive acquisition program 
CBA Competitive bidding area 
CFR Code of Federal Regulations 
CHIP Children’s Health Insurance Program 
CJIS Criminal Justice Information Services 
CLIA Clinical laboratory improvement 
amendments 

CMHC Community mental health centers 
CMS Centers for Medicare & Medicaid 
Services 

CON • Certificate of Need 
CoP Condition of participation 
CORF Comprehensive outpatient 
rehabilitation facility 

CPI-U Consumer price index for all urban 
consumers 

DAB Department Appeal Board 
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DEA Drug Enforcement Agency 
DHUD Department of Housing and Urban 
Development 

DME Durable medical equipment 
DMEPOS Durable medical equipment 
prosthetics, orthotics, and supplies 
DOB Dates of birth 
DOJ Department of Justice 
EIN Employer Identification Number 
EMTALA Emergency Medical Treatment 
and Active Labor Act 
VIN Vehicle Identifier Number 
ESRD End-stage renal disease 
EPLS General Service Administration’s 
Excluded Parties List System 
FBI Federal Bureau of Investigation 
FFP Federal Financial Participation 
FFS Medicare fee-for-service program 
FQHC Federally qualified health center 
GAO Government Accountability Office 
HHAs Home health agencies 
HHS (Department of] Health and Human 
Services 

HIO Health insuring organization 
lAFIS Integrated Automated Fingerprint 
Identification System 
ICF/MR Intermediate care facilities for 
persons with mental retardation 
IDTF Independent diagnostic testing facility 
IHCIA Indian Health Care Improvement Act 
IHS Indian Health Service 
IHSS In-home supportive services 
IPF Inpatient psychiatric facility 
IRF Inpatient rehabilitation facility 
ISDEAA Indian Self-Determination and 
Education Assistance Act 
LEIE List of Excluded Individuais/Entities 
MCEs Managed care entities 
MFCU Medicaid fraud control unit 
MAO Medicare Advantage organizations 
MMA Medicare Prescription Drug. 

Improvement, and Modernization Act of 
2003 (Pub. L, 108-173) 

NASDAQ National Association of 
Securities Dealers Automated Quotation 
System 

NF Nursing facility 
NPl National Provider Identifier 
NPPES National Plan and Provider 
Enumeration System 
NSC National Supplier Clearinghouse 
NTIS National TecWicai Information 
Service 

NPDB National Practitioner Data Bank 
NYSE New York Stock Exchange 
DIG Office of Inspector General 
□MB Office of Management and Budget 
OPO Organ procurement organization 
PAHP Prepaid ambulatory health plan 
PECOS Provider Enrollment, Chain, and 
Ownership System 
PIHP Prepaid inpatient health plan 
PSC Program Safeguard Contractors 
PTAN Provider transaction account number 
RFA Regulatory Flexibility Act 
RHC Rural health clinic 
RNHCi Religious nonmedical health care 
institution 

SEC Securities and Exchange Commission 
SMP Senior Medicare Patrol 
SNFs Skilled nursing facilities 
SPIA State Program Integrity Assessment 
SSA Social Security Administration 
SSA DMF Social Security Administration 
Death Master Fiie 
SSN Social Security Number 
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TTAG Tribal Technical Advisory Group 

WAN [FBI qiS Division’s! Wide Area 

Network 

ZPIC Zone Program Integrity Contractors 
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II. Proposed Provisions and Responses to 

Public Comments 

A. Provider Screening Under Medicare, 
Medicaid, and CHIP 

1. Statutory Changes 

2. Summary of Existing Screening 
Measures 

a. Licensure Requirements — Medicare and 
Medicaid 

b. Site Visits — Medicare 

c. Database Checks — Medicare 

d. Criminal Background Checks — Medicare 

e. Medicare MAO Requirements 

f. Fingerprinting — Medicare 

g. Screening — Medicaid and CHIP 

3. General Screening of Providers — 
Medicare 

a. Proposed Screening Requirements 

(1) Limited 

(2) Moderate 

(3) High 

b. Analysis of and Responses to Public 
Comment on Medicare Screening 
Categories 

c. Final Screening Provision — Medicare 

4- General Screening of Providers — 

Medicaid and CHIP; Proposed Provisions 
and Analysis of and Responses to Public 
Comments 

a. Database Checks — Medicaid and CHIP 

b. Unscheduled and Unannounced Site 
Visits — Medicaid and CHIP 

c. Provider Enrollment and Provider 
Termination — Medicaid and CHIP 

d. Criminal Background Checks and 
Fingerprinting — Medicaid and CHIP 

e. Deactivation and Reactivation of 
Provider Enrollment — Medicaid and 
CHIP 

f. Eniollment and NPI of Ordering or 
Referring Providers — Medicaid and CHIP 

g. Other State Screening — Medicaid and 
CHIP 

h. Final Screening Provisions — Medicaid 
and CHIP 

3. Solicitation of Additional Comments 
Regarding (he Implementation of the 

Fingerprinting Requirements 

B. Application Fee — Medicare, Medicaid, 
and CHIP 

1 . Statutory Changes 

2. Proposed Applicetion Fee Provisions 

C. Temporary Moratoria on Enrollment of 
Medicare Providers and Suppliers, 
Medicaid and CHIP Providers 

1. Statutory Changes 

2. Proposed Temporary Moratoria 
Provisions 

a. Medicare 

b. Medicaid and CHIP 

3. Analysis of and Responses to Public 
Comment 

4. Final Temporary Moratoria on 
Enrollment of Medicare Providers an d 
Suppliers, Medicaid and CHIP 
Provisions 

D. Suspension of Payments 

1. Medicare 

a. Background 


b. Previous Medicare Regulations 

c. Proposed Medicare Suspension of 
Payments Requirements 

2. Medicaid 

a. Background 

b. Previous Medicaid Regulations 

c. Proposed Medicaid Suspension of 
Payments Requirements 

E. Proposed Approach and Solicitation of 
Comments for Sections 6102 and B40l{a) 
of the Affordable Care Act — Ethics and 
Compliance Program 

1 . Statutory Changes 

2. Proposed Ethics and Compliance 
Program Provisions 

3. Analysis of and Responses to Public 
Comment 

4. Final Provisions — Ethics and 
Compliance Program 

F. Termination of Provider Participation 
Under the Medicaid Program and CHIP 
if Terminated Under the Medicare 
Program or Another State Medicaid 
Program or CHIP 

1. Statutory Change 

2. Proposed Provisions for Termination of 
Provider Participation Under the 
Medicaid Program and CHIP if 
Terminated Under the Medicare Program 
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Regulations Text 

I. Background 

The Medicare program (title XVIII of 
the Social Security Act (the Act)) is the 
primary payer of health care for 47 
million enrolled beneficiaries. Under 
section 1802 of the Act, a beneficiary 
may obtain health services from an 
individual or an organization qualified 
to participate in the Medicare program. 
Qualifications to participate are 
specified in statute and in regulations 
(see, for example, sections 1814, 1815, 
1819, 1833. 1834, 1842, 1861, 1866, and 
1891 of the Act: and 42 CFR Chapter IV, 
subchapter G, which concerns standards 
and certiRcation requirements). 

Providers and suppliers furnishing 
services must comply with the Medicare 
requirements stipulated in the Act and 
in our regulations. These requirements 
are meant to ensure compliance with 
applicable statutes, as well as to 
promote the furnishing of high quality 
care. As Medicare program expenditures 
have grown, we have increased our 
efforts to ensure that only qualified 
individuals and organizations are 
allowed to enroll or maintain their 
Medicare billing privileges. 

The Medicaid program (title XIX of 
the Act) is a joint Federal and State 
health care program for eligible low- 
income individuals providing coverage 
to more than 51 million people. States 
have considerable flexibility in how 
they administer their Medicaid 
programs within a broad Federal 
framework and programs vary from 
State to State. 

The Children's Health Insurance 
Program (CHIP) (title XXI of the Act) is 
a joint Federal and State health care 
program that provides health care 
coverage to more than 7.7 million 
otherwise uninsured children. 


Historically, States, in operating 
Medicaid and CHIP, have permitted the 
enrollment of providers who meet the 
State requirements for program 
enrollment. 

The Patient Protection and Affordable 
Care Act (Pub. L, 111-148), as amended 
by the Health Care and Education 
Reconciliation Act of 2010 (Pub. L. 111- 
152) (collectively known as the 
Affordable Care Act or ACA) makes a 
number of changes to the Medicare and 
Medicaid programs and CHIP that 
enhance the provider and supplier 
enrollment process to improve the 
integrity of the programs to reduce 
fraud, waste, and abuse in the programs. 

The following is an overview of some 
of the statutory authority relevant to 
enrollment in Medicare, Medicaid, and 
CHIP; 

• Sections 1102 and 1871 of the Act 
provide general authority for the 
Secretary of Health and Human Services 
(the Secretary) to prescribe regulations 
for the efficient administration of the 
Medicare program. Section 1102 of the 
Act also provides general authority for 
the Secretary to prescribe regulations for 
the efficient administration of the 
Medicaid program and CHIP. 

• Section 4313 of the Balanced 
Budget Act of 1997 (BBA) (Pub. L. 105- 
33) amended sections 1124(a)(1) and 

11 24 A of the Act to requite disclosure 
of both the Employer Identiilcation 
Number (EIN) and Social Security 
Number (SSN) of each provider or 
supplier, each person with ownership or 
control interest in the provider or 
supplier, any subcontractor in which 
the provider or supplier directly or 
indirectly has a 3 percent or more 
ownership interest, and any managing 
employees including directors and 
officers of corporations and non-profit 
organizations and charities. The “Report 
to Congress on Steps Taken to Assure 
Confidentiality of Social Security 
Account Numbers as required by the 
Balanced Budget Act” was signed by the 
Secretary and sent to the Congress on 
January 26, 1999. This report outlines 
the provisions of a mandatory collection 
of SSNs and EINs effective on or after 
April 26. 1999. 

• Section 936(a)(2) of the Medicare 
Prescription Drug, Improvement, and 
Modernization Act of 2003 (MMA) (Pub. 
L. 108-173) amended the Act to require 
the Secretary to establish a process for 
the enrollment of providers of services 
and suppliers. We are authorized to 
collect information on the Medicare 
enrollment application (that is, the 
CMS-855, (Office of Management and 
Budget (OMB) approval number 0938- 
0685)) to ensure that correct payments 
are made to providers and suppliers 


under the Medicare program as 
established by title XVIII of the Act. 

• Section 1902{a){27) of the Act 
provides general authority for the 
Secretary to require provider agreements 
under the Medicaid State Plans with 
every person or institution providing 
services under the State plan. Under 
these agreements, the Secretary may 
require information regarding any 
payments claimed by such person or 
institution for providing services under 
the State plan. 

• Section 2107(e) of the Act, which 
provides that certain title XIX and title 
XI provisions apply to States under title 
XX], including 1902(a)(4)(C) of the Act. 
relating to conflict of interest standards. 

• Section 1903{i)(2) of the Act 
relating to limitations on payment. 

• Section 1124 of the Act relating to 
disclosure of ownership and related 
information. 

• Sections 6401. 6402, 6501, and 
10603 of the ACA and 1304 of the 
Health Care and Education 
Reconciliation Act (Pub. L. 111-152) 
amended the Act by establishing: (I) 
Procedures under which screening is 
conducted for providers of medical or 
other services and suppliers in the 
Medicare program, providers in the 
Medicaid program, and providers in the 
CHIP; (2) an application fee to be 
imposed on providers and suppliers; (3) 
temporary moratoria that the Secretary 
may impose if necessary to prevent or 
combat fraud, waste, and abuse under 
the Medicare and Medicaid programs 
and CHIP; (4) requirements that State 
Medicaid agencies must terminate any 
provider that is terminated by Medicare 
or another State plan; (5) requirements 
for suspensions of payments pending 
credible allegations of fraud in both the 
Medicare and Medicaid programs, 

II, Proposed Provisions and Responses 
to Public Continents 

We received approximately 300 
timely pieces of correspondence 
containing multiple comments on the 
Additional Screening Requirements, 
Application Fees, Temporary 
Enrollment Moratoria, Payment 
Suspensions and Compliance Plans for 
Providers and Suppliers proposed rule 
published September 23, 2010 (75 FR 
58204). We note that we received some 
comments that were outside the scope 
of the proposed rule. These comments 
are not addressed in this final rule with 
comment period. Summaries of the 
public comments that are within the 
scope of the proposals and our 
responses to those comments are set 
forth in the various sections of this final 
rule with comment period under the 
appropriate headings. 
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A. Provider Screening Under Medicare, 
Medicaid, and CHIP 
1. Statutory Changes 

Section 6401(a) of the ACA, as 
amended by section 10603 of the ACA, 
amends section 1866(j) of the Act to add 
a new paragraph, paragraph “(2) 

Provider Screening.” Section 
1866{j){2)(A) of the Act requires the 
Secretary, in consultation with the 
Department of Health of Human 
Services’ Office of the Inspector General 
(HHS OIG), to establish procedures 
under which screening is conducted 
with respect to providers of medical or 
other items or services and suppliers 
under Medicare, Medicaid, and CHIP, 
Section 1866())(2KB3 of the Act requires 
the Secretary to determine the level of 
screening to be conducted according to 
the risk of fraud, waste, and abuse with 
respect to the category of provider of 
medical or other items or services or 
supplier, The provision stales that the 
screening shall include a licensure 
check, which may include such checks 
across State lines: and the screening 
may, as the Secretary determines 
appropriate based on the risk of fraud, 
waste, and abuse, include a criminal 
background check; fingerprinting: 
unscheduled or unannounced site visits, 
including pre-enrollment site visits; 
database checks, including such checks 
across State lines; and such other 
screening as the Secretary determines 
appropriate. Section 1866(i)(2)(C) of the 
Act requires the Secretary to impose a 
fee on each institutional provider of 
medical or other items or services or 
supplier that would be used by the 
Secretary for program integrity efforts 
including to cover the cost of screening 
and to carry out the provisions of 
sections 1866{j) and 1128J of the Act. 

We discussed the fee in section II. B. of 
the proposed rule. 

Section 6401(b) of the ACA amends 
section 1902 of the Act to add new 
paragraph (a}(77) and (ii), which 
requires States to comply with the 
process for screening providers and 
suppliers as established by the Secretary 
under 1866 (jK 2 ) of the Act.^ Note that 
section 640l{b} of the ACA erroneously 
added a duplicate section 190Z(ii) to the 


> We believe that the reference to sBCtion 
1886(iK2i of the Act in section 6401 (bill) of the 
ACA is a scrivener’s etror. We believe the Congress 
intended to refer to section 1866(j){2} of the Act. 
which, as amended by section 6401(a) of the ACA, 
requires the Secretary to establish a process for 
screening providers and suppliers. Because the 
drafting error is apparent, and a literal reading of 
the reference to section 18a6(j){2) of the Act would 
produce absurd results, we interpret the cro.ss- 
reference to section 1886{j)(2) in the new section 
1902(kk) of the Act as if the reference were to 
section 1866(iH2i. 


Act. Therefore, in the Medicare and 
Medicaid Extenders Act of 2010 (Pub. L. 
111-309), the Congress enacted a 
technical correction to redes^nate the 
section 190Z(ii) of the Act added by 
section 6401^) of ACA as section 
ig02(kk) of the Act. In this regulation, 
we therefore reference section 1902(kk) 
of the Act when referring to the 
provisions added by section 6401(b) of 
the ACA. 

We noted in the proposed rule that 
the statute uses the terms “providers of 
medical or other items or services,” 
"institutional providers," and 
“suppliers.” The Medicare program 
enrolls a variety of providers and 
suppliers, some of which are referred to 
as “providers of services,” “institutional 
providers,” “certified providers,” 
“certified suppliers,” and “suppliers.” In 
Medicare, the term “providers of 
services” under section 1861(u) of the 
Act means health care entities that 
furnish services primarily payable 
under Part A of Medicare, such as 
hospitals, home health agencies 
(including home health agencies 
providing services under Part B), 
hospices, and skilled nursing facilities. 
The term "suppliers” defined in section 
1861(d) of the Act refers to health care 
entities that furnish services primarily 
payable under Part B of Medicare, such 
as independent diagnostic testing 
facilities (IDTFs). durable medical 
equipment prosthetics, orthotics, and 
supplies (DMEPOS) suppliers, and 
eligible professionals, which refers to 
health care suppliers who are 
individuals, that is, physicians and the 
other professionals listed in section 
1848(k)(3KB) of the Act For Medicaid 
and CHIP, we use the terms “providers" 
or “Medicaid providers” or “CHIP 
providers” when referring to all 
Medicaid or CHIP health care providers, 
including individual practitioners, 
institutional providers, and providers of 
medical equipment or goods related to 
care. The term “supplier" has no 
meaning in the Medicaid program or 
CHIP. 

The new screening procedures 
implemented pursuantto new section 
186B{))(2) of the Act are applicable to 
newly enrolling providers and 
suppliers, including eligible 
professionals, beginning on March Z5, 

2011 . These new procedures are 
applicable to currently enrolled 
Medicare, Medicaid, and CHIP 
providers, suppliers, and eligible 
professionals loginning on March 23, 

2012. These new screening procedures 
implemented pursuant to new section 
1566(j)(2) of the Act are applicable 
beginning on March 25, 2011 for those 
providers and suppliers currently 


enrolled in Medicare, Medicaid, and 
CHIP who revalidate their enrollment 
information. Within Medicare, the 
March 25, 2011 implementation date 
will impact those current providers and 
suppliers whose 5-year revalidation 
cycle (or 3-year revalidation cycle for 
DMEPOS suppliers) results in 
revalidation occurring on or after March 
25, 2011 and before March 23, 2012. 

The requirements for revalidation are 
discussed in § 424.515. It is important to 
note that revalidation — for purposes of 
both provider enrollment in general and 
this final rule with comment period — 
does not include routine changes of 
information as described in § 424.516(d) 
and (e), such as address changes or 
changes in phone number. 

2. Summary of Existing Screening 
Measures 

Before we outline the new measures 
we are finalizing under the ACA. it may 
be helpful to provide a summary of 
some of the screening measures already 
being utilized in Medicare, Medicaid, 
and CHIP. Pursuant to other authority, 
but with the notable exception of 
background checks and fingerprinting, 
Medicare, generally through private 
contractors, already employs a number 
of the screening practices described in 
section J866{j)(2KB) of the Act to 
determine if a provider or supplier is in 
compliance with Federal ana State 
requirements to enroll or to maintain 
enrollment in the Medicare program- 

We also believe it important to note 
that nothing in this rule is intended to 
abridge our established screening 
authority under existing statutes and 
regulations or to diminish the screening 
that providers and suppliers currently 
undergo. To the contrary; the provisions 
specified in this final rule with 
comment period are intended to 
enhance our existing authority. This 
rule’s provisions, in other words, set 
“floors”— not ceilings— on enrollment 
requirements for each screening level. 

a. Licensure Requirements — Medicare 
and Medicaid 

Over the past several years, we have 
taken a number of steps to strengthen 
our ability to deny or revoke Medicare 
billing privileges when providers or 
suppliers do not have or do not 
maintain the applicable State licensure 
requirements for their provider or 
supplier type or profession. We 
established reporting responsibilities for 
all providers, suppliers, and eligible 
professionals in earlier regulations at 
§ 424.516(b) through (e). To ensure that 
only qualified providers and suppliers 
remain in the Medicare fee-for-service 
(FFS) program, we require that Medicare 
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contractors review State licensing board 
data on a monthly basis to determine if 
providers and suppliers remain in 
compliance with State licensure 
requirements. Medicare billing 
privileges would be revoked for those 
providers and suppliers who do not 
report a final adverse action (for 
example, license revocation or 
suspension, felony conviction) within 
the applicable reporting period, as 
required in § 424.51603) through (e), 
Medicare suppliers of DMEPOS and 
IDTFs are already subject to similar 
provisions in § 424, 57(c) and 
§ 410.33(g), respectively. DMEPOS 
suppliers are also subject to additional 
requirements including accreditation 
and surety bonding, pursuant to 
§ 424.57(c){22) through (26) and 
§424.57(d). 

Medicare Advantage organizations 
(MAOs) are required to verify licensure 
of providers and suppliers, including 
physicians and other health care 
professionals, in accordance with 
§422,204. 

For Medicaid and CHIP, most States 
do some checking of in-State provider 
licenses, but the extent of scrutiny 
varies. For example, in some States, the 
existence of the license may be verified, 
but little attention might be given to any 
restrictions on the license, 

b. Site Visits— Medicare 

Pursuant to §424,517. Medicare 
conducts the following site visits and 
takes the following actions, generally 
through private contractors under CMS 
direction; 

• The National Supplier 
Clearinghouse (NSC) Medicare 
Administrative Contractor (the Medicare 
contractor that processes enrollment 
applications for suppliers of DMEPOS) 
conducts pre'enroliment site visits to 
DMEPOS suppliers that are not 
associated with a chain supplier of 
DMEPOS (a chain supplier of DMEPOS 
is a supplier with 25 or more distinct 
practice locations,) 

• The NSC also conducts 
unannounced post-enrollment site visits 
to DMEPOS suppliers for which CMS or 
the NSC believes there is a likelihood of 
fraudulent or abusive activities to 
ensure those DMEPOS suppliers remain 
in compliance with the supplier 
standards found at § 424, 57(c). CMS at 
times exercises its right to — 

• Have the NSC conduct ad hoc pre- 
and post-enrollment site visits to any 
DMEPOS supplier; 

• Have Medicare contractors conduct 
pre-enrollment site visits to all IDTFs; 
and 

• Conduct ad hoc pre-and post 
enrollment site visits to any prospective 


Medicare provider and supplier or any 
enrolled Medicare provider or supplier. 

In addition, under 42 CFR parts 488 
and 489, a State survey agency or an 
approved national accreditation 
organization with deeming authority 
conducts pre-enrollment surveys for 
certified providers and suppliers to 
determine whether they meet the 
applicable Federal conditions and 
requirements for their provider or 
supplier type before they can participate 
in the Medicare program. 

We note that the site visits discussed 
here and elsewhere within this 
preamble and the final regulations are 
separate and apart from the site visits 
that are conducted pursuant to the 
Clinical Laboratory Improvement 
Amendments (CLIA). We will work with 
our Stale survey agency partners in 
coordinating these site visits so as to 
avoid duplication and burden on 
providers. 

c. Database Checks — Medicare 

Under existing regulation, Medicare 
contractors employ database checks of 
eligible professionals, owners, 
authorized officials, delegated ofGcials, 
managing employees, medical directors, 
and supervising physicians (at IDTFs 
and laboratories) as part of the Medicare 
provider and supplier enrollment 
process. These include database checks 
with the Soda! Security Administration 
(SSA) (to verify an individual’s SSN), 
the National Plan and Provider 
Enumeration System (NPPES) to verify 
the National Provider Identifier (NPi) of 
an eligible professional, and State 
licensing board checks to determine if 
an eligible professional is appropriately 
licensed to furnish medical services 
within a given State. These checks also 
include checking a provider or supplier 
against the HHS OIG’s List of Excluded 
Individuals/Entities (LEIE) and the 
General Service Administration's 
Excluded Parties List System (EPLS). 

All of the database checks have been 
used to assess the eligibility and 
qualifications of providers and suppliers 
to enroll in the Medicare program, to 
confirm the identity of an eligible 
professional to ensure that he or she 
may be considered for enrollment in the 
Medicare program. 

Also, on a monthly basis, CMS’ 
Medicare contractors systematically 
compare enrolled providers, suppliers, 
and eligible professionals against the 
information in the Medicare Exclusions 
Database. The Medicare Exclusions 
Database identifies providers, suppliers, 
and eligible professionals who have 
been excluded from the Medicare and 
Medicaid programs by the HHS OIG. 
When a match is found, the HHS OIG 


exclusion information is systematically 
noted in the Medicare enrollment record 
of the provider, supplier, or eligible 
professional. In the Medicare program, 
we deny or revoke the billing privileges 
of providers, suppliers, and eligible 
professionals who have been excluded 
by the HHS OIG. If the HHS OIG lifts the 
exclusion, the provider, supplier or 
eligible professional must reapply for 
enrollment in the Medicare program. In 
addition, Medicare contractors also 
review Slate licensure Web sites on a 
monthly basis to ensure that eligible 
professionals continue to meet State 
licensing requirements. 

In addition, since January 2009, we 
have compared date of death 
information obtained from the Social 
Security Administration Death Master 
File (SSA DMF) with the information 
maintained in the National Plan and 
Provider Enumeration System (NPPES), 
the system that assigns an NPI to 
individuals and organizations. Based on 
this comparison and the subsequent 
verification, we have deactivated the 
NPIs of more than 11,500 individuals 
who vyere previously assigned a type 1 
(individual) NPI, We automatically 
transfer this information from NPPES to 
the Provider Enrollment, Chain, and 
Ownership System (PECOS), CMS’ 
national Medicare enrollment repository 
to deactivate a deceased individual's 
Medicare billing privileges. In addition, 
Medicare contractors are required to 
review and act upon monthly files that 
contain a list of non-practitioner 
individuals enrolled in the Medicare 
program who have been reported to the 
SSA as deceased. These individuals 
include; Owners, authorized officials, 
and delegated officials. 

MAOs, as required by §422.204, 
generally use database checks to verify 
licensure and licensure sanctions and 
limitations with State licensing boards 
and the Federation of State Medical 
Boards, DEA certificates with the 
National Technical Information Service 
(NTIS), history of adverse professional 
review actions and malpractice horn the 
National Practitioner Data Bank (NPDB), 
accreditation status of institutional 
providers and suppliers with national 
accrediting boards, such as The Joint 
Commission (TJC), and search for HHS 
OIG exclusions using the HHS OIG Web 
site http://oig.hhs.gov/fraud/excJusions/ 
exclusions_Iist.asp. 

d. Criminal Background Checks — 
Medicare 

Section 6401(a) of the ACA amended 
Section 1866 {j) of the Act authorized the 
Secretary to perform criminal 
background checks. As described in 
§ 424.530(a) and § 424.535(a), CMS or its 
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designated Medicare contractor may 
deny or revoke the Medicare billing 
privileges of the owner of a provider or 
supplier, a physician or non-physician 
practitioner, and terminate any 
corresponding provider or supplier 
agreement for a number of reasons, 
including an exclusion from the 
Medicare, Medicaid, and any other 
Federal health care program, a felony 
within the preceding 10 years that is 
considered detrimental to the Medicare 
program, and/or submission of false or 
misleading information on the Medicare 
enrollment application. While we 
require our Medicare contractors to 
verify data submitted on, and as part of, 
the Medicare provider/supplier 
enrollment application, our contractors 
are not able to verify information that 
may have been purposefully omitted or 
changed in a manner to obfuscate any 
previous criminal activity. A 2005 
report issued by the National Task Force 
on the Criminal Backgrounding of 
America, sponsored by the Bureau of 
Justice Statistics and the U S. 
Department of Justice, defined a 
Criminal History Record Check as a 
check that returns records from official 
criminal repositories (meaning State 
repositories and the Federal Bureau of 
Investigations (FBI) Interstate 
Identification Index that links Federal 
and State criminal record systems), and 
the FBI uses the same terminology. For 
purposes of responding to comments in 
this document we use the term criminal 
history record check to mean criminal 
background checks when referring to 
such fingerprint-based checks. Criminal 
History Record Checks have not been 
historically used in the FFS Medicare 
enrollment screening process. 

e. Medicare MAO Requirements 
As mentioned earlier in this section. 
MAOs already employ a number of 
screening procedures in accordance 
with regulations and CMS manual 
instructions. Specifically, under 
§ 422.204(b)(3) in the case of providers 
meeting the definition of “provider of 
services” in section 186l(u) of the Act. 
basic benefits may only be provided 
through providers if they have a 
provider agreement with us permitting 
them to furnish services under original 
Medicare. With respect to other entities 
like suppliers, § 422.204(b)(3) requires 
that they “meet the applicable 
requirements of title XVIII and Part A of 
title XI of the Act.” Given these 
requirements we considered to what 
extent MAOs would be required to 
apply the identical screening 
requirements we proposed for the 
original Medicare program or whether 
substantively similar alternative 


approaches adopted by MAOs would be 
acceptable. Accordingly, we solicited 
public comments on whether or to what 
extent MAOs should be required to 
implement the same enhanced 
screening requirements for providers, 
suppliers and physicians that we 
proposed for the original Medicare 
program. 

f. Fingerprinting — Medicare 

Previous to this final rule with 
comment period fingerprinting and 
fingerprint-based criminal history 
record information from the FBI was not 
used in the Medicare enrollment 
screening process. 

g. Screening — Medicaid and CHIP 

States vary in the degree to which 
they employ screening methods such as 
unscheduled and unannounced site 
visits and database checks, including 
such checks across State lines, criminal 
background checks, and fingerprinting. 
However, at least a few States utilize 
each of those methods. 

States also varied in what they require 
their managed care entities (MCEs)* to 
do in terms of screening network-level 
providers that are not also enrolled in 
the Medicaid program as FFS providers. 
We considered to what extent States 
must require their MCEs to apply the 
identical screening requirements we 
proposed for the States or whether 
substantively similar alternative 
approaches adopted by MCEs are 
acceptable. Accordingly, we solicited 
public comments on whether or to what 
extent MCEs should be required to 
implement (ho same enhanced 
screening requirements for Medicaid 
and CHIP providers that we proposed 
for State Medicaid and CHIP programs. 

We again stress that the provider 
enrollment verification tools that we are 
currently using— including, but not 
limited to, those described previously— 
will not in any way be diminished as a 
result of this final rule with comment 
period. In other words, the validation 
techniques in this rule do not supplant 
those that are presently in use. 


2 For purposes of (Ms preamble and the final 
regulations, “managed care entity" and “MCE” will 
have (he meaning Medicaid managed care 
organization (MCO), primary care case manager 
(FCCM). prepaid inpatient health plan (PIHP), 
prepaid ambulatory health plan (PAHP). and health 
insuring organization (HIO). This definition differs 
horn the meaning in section lQ32(aHlKB) of the 
Social Security Act. which limits MCEs to Medicaid 
MCOs and PCCMs. We are using a more inclusive 
deHnition Cor the regulation so (hat all those entities 
in States' managed care programs will provide 
disclosure information. 


3. General Screening of Providers — 
Medicare 

a. Proposed Screening Requirements 

Section 1866{j)(2)(B) of the Act 
requires the Secretary to determine the 
level of screening applicable to 
providers and .suppliers according to the 
risk of fraud, waste, and abuse the 
Secretary determines is posed by 
particular provider and supplier 
categories. 

In considering how to establish 
consistent screening standards, we 
proposed to designate provider and 
supplier categories that are subject to 
certain screening procedures based on 
CMS’ assessment of fraud, waste and 
abuse risk of the provider or supplier 
category, taking into consideration a 
variety of factors. These factors include 
our own experience with claims data 
used to identify fraudulent billing 
practices as well as the expertise 
developed by our contractors charged 
with investigating and identifying 
instances of Medicare fraud across a 
broad spectrum of providers. In 
addition, CMS has relied on insights 
gained from numerous studies 
conducted by the HHS-OIG, GAO, and 
other sources. We have designated 
categories of providers or suppliers (for 
example, “newly enrolling DME 
suppliers” or “currently enrolled home 
health agencies”) that are subject to 
screening procedures based on our 
assessment of the level of screening 
based on the risk presented by the 
category of provider, There are three 
levels of screening and associated risk; 
“limited," “moderate" and “high,” and 
each provider/supplier category is 
assigned to one of these three screening 
levels. The categories described below 
and associated risk levels assigned are 
designed to identify those categories of 
providers and suppliers that pose a risk 
of fraud, waste, and abuse. 

The screening procedures applicable 
to each screening level are set by us and 
are included in this final rule with 
comment period. Under this approach, 
the relevant Medicare contractor (for 
example, fiscal intermediary, regional 
home health intermediary, carriers, Part 
A or Part B Medicare Administrative 
Contractor (A/B MAC), or the NSC 
Administrative Contractor) would 
utilize the screening tools mandated by 
us for the screening level assigned to a 
particular provider or supplier category. 

We solicited comments on the 
proposed assignment of specific 
provider and supplier types to the 
proposed risk screening levels, 
including what criteria should be 
considered in making such assignments, 
whether such a,ssignments should be 
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released publicly, whether they should 
be subject to agency review and updated 
according to an established schedule 
(that is, annually, bi-annually), and the 
extent to which they should be updated 


according to evolving risks. We also 
solicited comments on any additional 
database checks that we should consider 
as a type of screening. 


Based on the level of screening 
assigned, we proposed that the 
Medicare contractors would establish 
and conduct the following categorical 
screenings. 


Table 1 — Proposed Screening Levels and Procedures for Medicare Physicians, Non-Physician 
Practitioners, Providers, and Suppliers 


Type of screening required 


Limited 


Moderate 


High 


Verification of any provider/supplier-spedfic requirements established by Medicare 

Conduct license verifications, (may include licensure checks across States) 

Database Checks (to verity Social Security Number (SSN), the National Provider Identifier 
(NPI), the National Practitioner Data Bank (NPDB) licensure, an OIG exclusion; taxpayer 
identification number; tax delinquency; death of individual practilkmer, owner, authorized 

official, delegated official, or supen/ising physician) 

Unscheduled or Unannounced Site Visits 

Criminal Background Check 

Fingerprinting 



X 

X 


X 

X 

X 

X 


As described previously, we already 
require Medicare contractors to ensure 
that every provider or supplier meets 
any applicable Federal regulations or 
State requirements, including applicable 
licensure requirements^ for the provider 
or supplier type prior to making an 
enrollment determination. In addition, 
we also require that Medicare 
contractors conduct monthly reviews of 
State licensing board actions to 
determine if an individual practitioner, 
such as a physician or non-physician 
practitioner continues to meet State 
licensing requirements. In the case of 
organizational entities, we also require 
our Medicare contractors to condyct 
monthly or periodic checks to 
determine if an organizational entity 
continues to meet the Federal and State 
requirements for its provider or supplier 
type. Such verifications help ensure that 
a prospective provider or supplier is 
eligible to participate in the Medicare 
program or that an existing provider or 
supplier is eligible to maintain its 
Medicare billing privileges. 

Previous to this final rule with 
comment period, in the Medicare 
program. DMEPOS suppliers were 
required to re-enroll every 3 years, and 
other providers were required to 
revalidate their enrollment every 
5 years, The terms revalidation and re- 


’We note ihal under section 408 of the 
reauthorized Indian Health Care Improvement Act, 
‘Ta)ny requirement for participation as a provider of 
health care services under a Federal health care 
program that an entity be licensed or recognized 
under the Slate or local law where the entity is 
located to furnish health care services shall be 
deemed to have been met in the case of an entity 
operated by the [Indian Health] Service, an Indian 
tribe, tribal organization, or urban Indian 
organization if the cniily meets all the applicable 
standards for such licensure or recognition, 
regardless of whether the entity obtains a license or 
other documentation under such State or. local law.” 
25 U.S.C, 16478. 


enrollment were often used 
interchangeably, but are actually 
specific to these provider types. To 
eliminate any confusion about which 
term applies to which provider or 
supplier, we proposed language at 
§424.57(e) to change all references from 
re-enroll or re-enrollment to revalidate 
or revalidation. In addition, the ACA 
requires that no provider or supplier 
shall be allowed to enroll in Medicare 
or revalidate its enrollment in Medicare 
after March 23, 2013 without being 
screened pursuant to the authorities 
covered by this final rule with comment 
period. To assist us in assuring that the 
statutory effective date is met, we 
proposed at §424.515 to permit us to 
require that a provider or supplier 
revalidate its enrollment at any time. 
After the revalidation, the current cycle 
for revalidation (3 years for DMEPOS, 
and 5 years for ail other providers) 
would apply. 

(1) Limited 

Based on our own analysis of 
historical trends and our own 
experience with provider screening and 
enrollment we proposed that, as a 
category, the following providers and 
suppliers pose a limited risk to the 
Medicare program: Physician or non- 
physician practitioners and medical 
groups or clinics; providers or suppliers 
that are publicly traded on the NYSE or 
NASDAQ; ambulatory surgical centers 
(ASCs); end-stage renal disease (ERSD) 
facilities; Federally qualified health 
centers (FQHCs); histocompatibility 
laboratories; hospitals, including critical 
access hospitals (CAHs); Indian Health 
Service (IHS) facilities: mammography 
screening centers; organ procurement 
organizations (OPOs); mass 
immunization roster billers, portable x- 
ray suppliers; religious nonmedical 


health care institutions (RNHCIs); rural 
health clinics (RHCs); radiation therapy 
centers; skilled nursing facilities (SNFs), 
and public or government-owned 
ambulance services suppliers. 

In § 424.518(a), we proposed that the 
following screening tools will apply to 
providers and suppliers in categories 
designated as limited risk: (1) 
Verification that a provider or supplier 
meets any applicable Federal 
regulations, or State requirements for 
the provider or supplier type prior to 
making an enrollment determination; (2) 
verification that a provider or supplier 
meets applicable licensure 
requirements; and (3) database checks 
on a pre- and post-enrollment basis to 
ensure that providers and suppliers 
continue to meet the enrollment criteria 
for their provider/supplier type. 

To assist readers in understanding the 
type of providers and suppliers that we 
proposed to include in the limited risk 
screening level, we are providing the 
following table. 

Table 2— Proposed Medicare Pro- 
viders AND Suppliers Designated 
AS A “Limited” Categorical Risk 
for Screening Purposes 


Provider/suppiier category 

Physician or non-physician practitioners and 
medical groups or clinics. 

Providers or suppliers that are publicly traded 
on the NYSE or NASDAQ. 
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Table 2— Proposed Medicare Pro- 
viders AND Suppliers Designated 
AS A “Limited” Categorical Risk 
FOR Screening Purposes— Con- 
tinued 


Provider/supplier category 


Ambulatory surgical centers, end-stage renal 
disease facilities, Federally qualified health 
centers, histocompatibility laboratories, 
hospitals, including critical access hos- 
pitals, Indian Health Service fadlities, 
mammography screening centers, organ 
procurement organizations, mass immuni- 
zation roster billers, portable x-ray supplier, 
religious non-medical health care institu- 
tions. rural health clinics, radiation therapy 
centers, skilled nursing facilities, and public 
or government-owned or -affiliated ambu- 
lance service suppliers. 


(2) Moderate 

Based on our experience, we 
proposed that community mental health 
centers (CMHCsl; comprehensive 
outpatient rehabilitation facilities 
(CORFs); hospice organizations; 
independent diagnostic testing facilities 
{IDTFs}: independent clinical 
laboratories; and non-public, non- 
government owned or affiliated 
ambulance services suppliers pose a 
moderate risk to the Medicare program. 
However, we provided that any such 
provider or supplier that is publicly 
traded on the nVsE or NASDAQ would 
be considered limited risk. Furthermore, 
we proposed that currently enrolled 
(revalidating] home health agencies 
would be considered “moderate” risk, 
except any such provider that is 
publicly traded on the NYSE or 
NASDAQ would be considered limited 
risk, Finally, we proposed that currently 
enrolled (re-validating) suppliers of 
DMEPOS pose a moderate risk, except 
that any such supplier that is publicly 
traded on the NYSE or NASDAQ would 
be considered "limited” risk. We 
provide our rationale for these 
categories in this section below. 

For those provider and supplier 
categories in the “moderate” screening 
level, we proposed that Medicare 
contractors would conduct 
unannounced pre- and/or post- 
enrollment site visits in addition to 
those screening tools applicable to the 
limited level of screening. Based on the 
success of pre-and/or post enrollment 
site visits conducted by the NSC during 
the enrollment process for suppliers of 
DMEPOS and a similar process 
established by carriers and A/B MACs 
during the enrollment of IDTFs, we 
believe that unscheduled and 
unannounced pre-and post-enrollment 
site visits help ensure that suppliers are 


operational and meet applicable 
supplier standards or performance 
standards, in addition, we believe that 
unscheduled and unannounced pre-and 
post-enrollment site visits are an 
essential tool in determining whether a 
provider or supplier is in compliance 
with its reporting responsibilities, 
including the requirement in §424.516 
to notify the Medicare contractor of any 
change of practice location. 

Moreover, § 424.530(a)(5) and 
§ 424.535(a)(5} give us the authority to 
deny or revoke Medicare billing 
privileges for providers and suppliers if 
the provider or supplier is not 
operational or the provider does not 
maintain the established provider or 
supplier performance standards. And 
while we do not believe that 
unscheduled or unannounced site visits 
are necessary for all providers and 
suppliers, we do believe that a number 
of businesses, like the ones mentioned 
below, pose an increased risk to the 
Medicare program, due at least in part 
to the lack of individual professional 
licensure. 

In addition, as discussed below, we 
have found that certain types of 
providers and suppliers that easily enter 
a line or business without clinical or 
business experience — for example, by 
leasing minimal office space and 
equipment— present a higher risk of 
possible fraud to our programs. As such, 
we believe that because these types of 
providers pose an increased risk of 
fraud they should be subject to 
substantial scrutiny before being 
permitted to enroll and bill Medicare, 
Medicaid, or CHIP. This type of pre- 
enrollment scrutiny will help us move 
away from the “pay and chase" 
approach. 

Most of the provider and supplier 
categories in the moderate screening 
level are generally highly dependent on 
Medicare, Medicaid, or CHIP to pay 
their salaries and other operating 
expenses and are subject to less 
additional government or professional 
oversight than the providers and 
suppliers in the limited risk screening 
level. Accordingly, we believe it is 
appropriate and necessary to conduct 
unscheduled and unannounced pre- 
enrollment site visits to ensure that 
these prospective providers and 
suppliers meet our enrollment 
requirements prior to enrolling in the 
Medicare program. Moreover, we 
believe that post-enrollment site visits 
are also important to ensure that the 
enrolled provider or supplier remains a 
viable health care provider or supplier 
in the Medicare program. 

Accordingly, we proposed in 
§ 424.518(b) that in addition to the 


categorical screening tools used with 
respect to limited risk providers and 
suppliers, Medicare contractors would 
conduct unannounced and unscheduled 
site visits prior to enrolling the 
providers and suppliers assigned to the 
moderate risk screening level, as set 
forth earlier in this Section. 

In the proposed rule, we set forth our 
rationale for the assessment of risk 
ascribed to the providers and suppliers 
assigned to the “moderate” level of 
screening. First, we noted that HHS OIG 
and GAO have issued studies indicating 
that several of the provider and supplier 
types cited previously pose an elevated 
risk of fraud, waste and abuse to the 
Medicare and Medicare programs and 
CHIP. In an October 2007 report titled, 
“Growth in Advanced Imaging Paid 
under the Medicare Physician Fee 
Schedule” (OEI-01-06-00260]. the HHS 
OIG recommended that CMS consider 
conducting site visits to monitor IDTFs’ 
compliance with Medicare 
requirements.” In addition, in an April 
2007 report titled, “Medicare Hospices: 
Certification and Centers for Medicare & 
Medicaid Services Oversight” (OEI-06- . 
05—00260), the HHS OIG recommended 
that CMS seek legislation to establish 
additional enforcement remedies for 
poor hospice performance. In response 
to this recommendation, CMS stated 
that it was considering whether to 
pursue new enforcement remedies for 
poor hospice performance. While the 
Medicare enrollment process is not 
designed to verify the conditions of 
participation, we do believe that more 
frequent onsite visits may help identify 
those hospice organizations that are no 
longer operational at the practice 
location identified on the Medicare 
enrollment application. 

In a January 2006 report titled, 
“Medicare Payments for Ambulance 
Transports” (OEl-05-02-000590), the 
HHS OIG found that “25 percent of 
ambulance transports did not meet 
Medicare's program requirements, 
resulting in an estimated $402 million 
in improper payments.” 

In an August 2004 report titled, 
“Comprehensive Outpatient 
Rehabilitation Facilities: High Medicare 
Payments in Florida Raise Program 
Integrity Concerns” (GAO-04-709), the 
GAO concluded that, 'isjizeable 
disparities between Medicare therapy 
payments per patient to Florida CORFs 
and other facility-based outpatient 
therapy providers in 2002 — with no 
clear indication of differences in patient 
needs — raise questions about the 
appropriateness of CORF billing 
practices. After finding high rates of 
medically unnecessary therapy services 
to CORFs. CMS’s claims administration 
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contractor for Florida took steps to 
ensure appropriate claim payments for a 
small, targeted group of CORF patients. 
Despite its limited success, billing 
irregularities continued among some 
CORFs and many CORFs continued to 
receive relatively high payments the 
following year. This suggests that the 
contractor's efforts were too limited in 
scope to be effective with all CORF 
providers.” 

In addition to GAO and HHS OIG 
studies and reports, a number of Zone 
Program Integrity Contractors (ZPIC) 
and Program Safeguard Contractors 
(PSC) used by CMS in helping to fight 
fraud in Medicare, have taken a number 
of administrative actions including 
payment suspensions and increased 
medical review, for the provider and 
supplier types shown previously. For 
example, the Zone 7 ZPIC contractor in 
South Florida has conducted onsite 
reviews at 62 CORFs since January 2010 
and recommended revocation for 51 
CORFs, or 82 percent of the CORFS in 
the area. The same contractor has 
conducted an onsite reviews at 38 
CMHCs located in Dade, Broward, and 
Palm Beach County since January 2010, 
and recommended that 30 CMHCs be 
revoked fornoncompliance (79 percent 
of the CMHCs in the area), In each 
instance where the ZPIC requested a 
revocation, the CMHC was also placed 
on prepay review. We have also 
conducted an analysis of IDTF licensure 
requirements and have found several 
circumstances that indicate irregularity 
and potential risk of fraud. Although 
independent clinical laboratories are 
subject to survey against CLIA 
requirements, there are nonetheless a 
number of potentials for fraud, not the 
least of which is the sheer volume of 
service and associated billing generated 
by these entities. 

We believe that there is ample 
evidence to support the use of post- 
enrollment site visits as a reliable and 
effective tool to ensure that a current 
supplier of DMEPOS remains 
operational and continues to meet the 
supplier standards found in § 424.57(c). 
In a March 2007 report titled, ‘‘Medical 
Equipment Suppliers Compliance with 
Medicare Enrollment Requirements” 
(OEI-04-05-00380), the HHS OIG 
concluded that. “By helping to ensure 
the legitimacy of DMEPOS suppliers, 
out-of-cycle site visits may help to 
prevent fraud, waste, and abuse in the 
Medicare program. CMS may want to 
consider the findings of our study as 
they determine how and to what extent 
out-of-cycle site visits of DMEPOS 
suppliers will occur,” Today, the NSC 
MAC utilizes post-enrollment site visits 
as the primary screening to determine 


ongoing compliance with the 
enrollment criteria set forth in 
§ 424, 57(c). Therefore, we have included 
currently enrolled DMEPOS suppliers in 
the “moderate" category. 

We also noted that, in addition to the 
new screening measures proposed In the 
proposed rule under the existing 
regulation at §424.517, a Medicare 
contractor may conduct an 
unannounced or unscheduled site visit 
at any time for any provider or supplier 
type prior to enrolling a prospective 
provider or supplier or for any existing 
provider or supplier enrolled in the 
Medicare program. While the primary 
purpose of an unannounced and 
unscheduled site visit is to ensure that 
a provider or supplier is operational at 
the practice location found on the 
Medicare enrollment application, a 
Medicare contractor may also verify 
establi.shed supplier standards or 
performance standards other than 
conditions of participation (CoP) subject 
to survey and certification by the State 
Survey agency, where applicable, to 
ensure that the supplier remains in 
compliance with program requirements. 

To assist readers in understanding the 
type of providers and suppliers that we 
proposed to be in the “moderate” risk 
screening level, we are providing the 
following table. 

Table 3— Proposed Medicare Pro- 
viders AND Suppliers Designated 
AS a “Moderate” Categorical 
Risk for Screening Purposes 


Provider/supplier category 

Community mental health centers; com- 
prehensive outpatient rehabilitation taciii- 
ties: hospice organizations; independent di- 
agnostic testing facilities; independent clin- 
ical laboratories; and non-public, non-gov- 
ernment owned or affiliated ambulance 
services suppliers. (Except that any such 
provider or supplier that is publicly traded 
on the NYSE or NASDAQ is considered 
“limited” risk.) 

Currently enrcrfled (revalidating) home health 
agencies. (Except that arty such provider 
that is publicly traded on the NYSE or 
NASDAQ is considered “limited” risk.) 

Currently enrolled (re-validating) suppliers of 
DMEPOS. (Except that any sur* supplier 
that is puMicIy traded on the NYSE or 
NASDAQ is considered ‘'limited” risk.) 


(3) High 

For those provider and supplier 
categories assigned the “high" level of 
screening, we proposed that, in addition 
to the screening tools applicable to the 
limited and moderate level of screening. 
Medicare contractors would use the 
following screening tools in the 
enrollment process: (1) Criminal 


background check: and (2) submission 
of fingerprints using the FD-258 
standard fingerprint card, (The FD-258 
fingerprint card is recognized nationally 
and can be found at local, county or 
State law enforcement agencies where, 
for a fee, agencies will supply the card 
and take the fingerprints.) We proposed 
that these tools would be applied to 
owners, authorized or delegated officials 
or managing employees of any provider 
or supplier assigned to the “high” level 
of screening. We believe that criminal 
background checks will assist us in 
determining if such individuals 
submitted a complete and truthful 
Medicare enrollment application and 
whether an individual is eligible to 
enroll in the Medicare program or 
maintain Medicare billing privileges. 

We believe that this position is 
supported by testimony of the GAO 
before the subcommittees for Health and 
Oversight and Ways and Means within 
the House of Representatives on june 
15. 2010, stating in part that “[c]hecking 
the background of providers at the time 
they apply to become Medicare 
providers is a crucial step to reduce the 
risk of enrolling providers intent on 
defrauding or abusing the program. !n 
particular, we have recommended 
stricter scrutiny of enrollment processes 
for two types of providers whose 
services and items CMS has identified 
as especially vulnerable to improper 
payments — home health agencies 
(HHAs) and suppliers of durable 
medical equipment, prosthetics, 
orthotics, and supplies (DMEPOS),” 

In § 424.518(c)il), we proposed that, 
unless they are publicly traded on the 
NYSE or NASDAQ, newly anrolling 
HHAs and suppliers of DMEPOS would 
be assigned to the high risk screening 
level. Based on our experience and on 
work conducted by the HHS OIG and 
the GAO, and because we do not have 
the monitoring experience with newly 
enrolling DMEPOS suppliers or HHAs 
that we have with those currently 
enrolled, we assigned these providers 
and suppliers to the “high” risk 
screening level, We are especially 
concerned about newly eruolling HHAs 
and suppliers of DMEPOS because of 
the high number of HHAs and suppliers 
of DMEPOS already enrolled in the 
Medicare program and program 
vulnerabilities that these entities pose to 
the Medicare program. Below is a list of 
HHS OIG and GAO reports identifying 
home health agencies and suppliers of 
DMEPOS as posing an elevated risk to 
the Medicare program. 

• In a December 2009 report titled, 
“Aberrant Medicare Home Health 
Outlier Payment Patterns in Miami- 
Dade County and Other Geographic 
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Areas in 2008” {OEi-04-08-00570), the 
HHS OIG recommended that CMS 
continue with efforts to strengthen 
enrollment standards for home health 
providers to prevent illegitimate HHAs 
from obtaining billing privileges. 

• In a February 2009 report titled, 
“Medicare: Improvements Needed to 
Address Improper Payments in Home 
Health” (GAO-09-ia5}, the GAO 
concluded that the Medicare enrollment . 
process does not routinely include 
verification of the criminal history of 
applicants, and without this information 
individuals and businesses that 
misrepresent their criminal histories or 
have a history of relevant convictions, 
such as for fraud, could be allowed to 
enter the Medicare program. In addition, 
the GAO recommended that CMS assess 
the feasibility of verifying the criminal 
history of all key officials named on the 
Medicare enrollment application. 

• In a February 2008 report titled, 

“Los Angeles County Suppliers’ 
Compliance with Medicare Standards: 
Results from Unannounced Visits” 
(OEI-Q9-07-0Q550) and in a March 
2007 report titled, “South Florida 
Suppliers’ Compliance with Medicare 
Standards: Results from Unannounced 
Visits (OEI-03-07~Q015Q}, the HHS OIG 
recommended that CMS strengthen the 
Medicare DMEPOS supplier enrollment 
process and ensure that suppliers meet 
Medicare supplier standards. The HHS 
OIG provided several options to 
implement this recommendation 
including: (1) Conducting more 
unannounced site visits to suppliers: (2) 
performing more rigorous background 
checks on applicants; (3) assessing the 
fraud risk of suppliers; and [4) targeting, 
monitoring, and enforcement of high 
risk suppliers. 

• In a September 2005 report titled, 
“Medicare; More Effective Screening 
and Stronger Enrollment Standards 
Needed for Medical Equipment 
Suppliers” (GAO-05-656), the GAO 
concluded that, 

CMS is responsible for assuring that 
Medicare beneficiaries have access to the 
equipment, supplies, and services they need, 
and at the same time, for protecting the 
program from abusive billing and fraud. The 
supplier standards and NSC’s gate keeping 
activities were intended to provide assurance 
that potential suppliers are qualified and 
would comply with Medicare rules. 

However, there is overwhelming evidence — 
in the form of criminal convictions, 
revocations, and recoveries — that the 
enrollment processes and the standards are 
not strong enough to thoroughly protect the 
program from fraudulent entities. We believe 
that CMS must focus on strengthening the 
standards and overseeing the supplier 
enrollment process, it needs to better focus 
on ways to scrutinize suppliers to ensure that 


they are responsible businesses, analogous to 
Federal standards for evaluating potential 
contractors. 

We recognize that there may also be 
circumstances where a particular 
provider or supplier or group of 
providers and suppliers may pose a 
higher risk of fraud, waste, and abuse 
than the screening level assignment for 
their category assessed. Therefore, in 
§ 424.518(c)(3), we proposed speciHc 
criteria that we would use to adjust the 
classification of a provider or supplier 
into a higher risk screening level than 
would generally apply to the entire 
category of provider or supplier, in 
order to address specific program 
vulnerabilities. We solicited comments 
on specihc additional circumstances 
that might justify shifting a provider or 
supplier into a higher screening level 
than would generally apply to its 
category. We also solicited comments on 
the criteria that we could use to shift the 
screening level back down. 

In §424.518{c)(3)(i), we proposed to 
adjust a provider or supplier from the 
limited or “moderate” risk screening 
level to the “high” risk screening level 
when we have evidence from or 
concerning a physician or non- 
physician practitioner that another 
individual is using his or her identity 
within the Medicare program. In 
§ 424.518(c)(3}(ii) and (iii), which in this 
final rule with comment period has 
been redesignated §424.518(c}(3)(i) and 
(it), we proposed to adjust a provider or 
supplier from the “limited” or 
“moderate” level of screening to the 
“high” screening level when: The 
provider or supplier has been placed on 
a previous payment suspension within 
the previous ten years; or the provider 
or supplier has been excluded by the 
HHS OIG or had its Medicare billing 
privileges revoked by a Medicare 
contractor within the previous 10 years 
and is attempting to establish additional 
Medicare billing privileges for a new 
practice location or by enrolling as a 
new provider or supplier. In addition, 
we believe that providers that have been 
terminated or otherwise precluded from 
billing Medicaid should be adjusted 
from the “limited” or “moderate" 
screening level to the “high" screening 
level. We believe that such providers or 
suppliers pose an elevated level of risk 
to the Medicare program. 

In §424.518(c](3)(iv), redesignated in 
this final rule with comment period as 
§424.519(c)(3){iii), we proposed to 
adjust providers or suppliers from the 
“limited” or “moderate” level of 
screening to the “high” level of 
screening for 6 months after we lift a 
temporary moratorium (see section il.C. 
of this final rule with comment period) 


applicable to such providers or 
suppliers. This would include providers 
and suppliers revalidating their 
enrollment if the moratorium is 
applicable to the provider or supplier 
type. We solicited comments on criteria 
that would justify reassignment of 
providers or suppliers from the 
“limited” or “moderate” screening level 
to the “high” screening level. We also 
solicited comments on criteria 
appropriate to the reassignment from 
“high” to “moderate” screening levels or 
“limited” screening levels. We also 
solicited comment on the applicability 
of geographical circumstances as a 
possible criterion for adjusting 
providers or suppliers from one 
screening level to another. We also 
solicited comment on whether non- 
practitioner owned facilities and 
suppliers should be subject to a higher 
level of screening than their 
practitioner-owned counterparts or, 
whether there is an appropriate 
corresponding trigger for non- 
practitioner owned facilities and 
suppliers. We solicited comment on 
whether providers and suppliers should 
be subject to higher levels of screening 
when the provider specialty does not 
match clinic type on an enrollment 
application. We solicited comment on 
what objective conditions might support 
a broad set of circumstances or factors 
that would allow us to determine that 
rovider screening levels by risk should 
e based on “other conditions or factors 
that CMS determines are necessary to 
combat fraud, waste, and abuse.” 

We solicited public comment on the 
appropriateness of using criminal 
background checks in the provider 
enrollment .screening process, including 
the instances when such background 
checks might be appropriate, the 
process of notifying a provider, supplier 
or individual that a criminal 
background check is to be performed, 
and the frequency of such checks. 

We solicited comment on the use of 
fingerprinting as a screening measure in 
our programs. We recognized that 
requesting, collecting, analyzing, and 
checking fingerprints from providers 
and suppliers are complex and sensitive 
undertakings that place certain burdens 
on affected individuals. There are 
privacy concerns and operational 
concerns about how to assure individual 
privacy, how to check fingerprints 
against appropriate law enforcement 
fingerprint databases, and how to store 
the results of the query of the data bases 
and also how to handle the subsequent 
analysis of the results. As a result, we 
solicited comments on how CMS or its 
contractor should maintain and store 
fingerprints, what security processes 
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and measures are needed to protect the 
privacy of individuals, and any other 
issues related to the use of fingerprints 
in the enrollment screening process. We 
were interested in comments on 
possible circumstances in which 
fingerprinting would be potentially 
useful in provider screening or other 
fraud prevention efforts. Our proposed 
screening approach contemplated 
requesting fingerprints from providers 
and suppliers designated as presenting 
a “high” risk of fraud. We solicited 
comment on this requirement, the 
circumstances under which it is 
appropriate, limitations on its use and 
any alternatives to the proposed 
approach regarding fingerprints, Our 
proposed approach allowed denial of 
billing privileges to newly enrolled 
providers and suppliers and revocation 
of billing privileges for revalidating 
providers and suppliers if owners or 
officials of providers or suppliers 
refused to submit fingerprints when 
requested to do so. We solicited 
comments on this proposal including its 
appropriateness and utility as a fraud 
prevention tool. In addition, we also 
solicited comment on the applicability 
and appropriateness of using, in 
addition to or in lieu of fingerprinting, 
other enhanced identification 
techniques end secure forms of 
identification including but not limited 
to other biological or biometric 
techniques, passports, United States 
Military identification, or Real ID 
drivers licenses. As technology and 
secure identification techniques change, 
the tools we use may change to reflect 
improvements or shifts in technology or 
in risk identification. We solicited 
comment on the appropriate uses of 
these techniques. 

We noted that any physician or non- 
physician practitioner or organizational 
provider or supplier that is denied 
enrollment into the Medicare program 
or whose Medicare billing privileges are 
revoked is afforded due process rights 
under §405,874. 

To assist readers in understanding the 
type of providers and suppliers that we 
proposed to include in the "high” risk 
screening level, we are providing the 
following table. 


Table 4 — Proposed Medicare Pro- 
viders AND Suppliers Designated 
AS a “High” Categorical Risk 
FOR Screening Purposes 


Provider/supplier category 

Prospective (newly enroffing) home health 
agencies and supfriiers of DMEPOS. (Ex- 
cept that any such provider or supplier that 
is publicly traded on the NYSE or 
NASDAQ is cor^idered “limited” risk.) 


The new screening procedures 
implemented pursuant to new section 
1866()}(2) of the Act will be applicable 
to newly enrolling categories providers 
and suppliers beginning on March 25, 
2011. These new screening procedures 
will also be applicable beginning on 
March 25, 2011 for those providers and 
suppliers currently enrolled in 
Medicare, Medicaid, and CHIP who 
revalidate their enrollment information. 
For Medicare, this will impact those 
providers and suppliers whose 
revalidation cycle results in revalidation 
occurring between March 25, 2011 and 
March 23, 2012. Finally, these new 
procedures will be applicable to 
currently enrolled Medicare, Medicaid, 
and CHIP providers and suppliers 
beginning on March 23, 2012, in 
accordance with section 1066(j)(2)(ii) of 
the Act. As such, some providers and 
suppliers may be required to revalidate 
their enrollment outside of their regular 
revalidation cycle. However, the 
additional screening procedures for 
categories and individuals in the high 
level of screening, namely, as discussed 
below, fingerprint-based criminal 
history record checks, will be 
implemented 60 days following the 
publication of subregulatory guidance. 

b. Analysis of and Responses to Public 
Comment on Medicare Screening 
Categories 

Below is a summary of the comments 
we received regarding the screening 
categories and the validation activities 
contained within each category. 

Comment: Several commenters 
expressed concern that we differentiated 
between publicly traded and non- 
publicly traded entities. Many 
commenters stated that CMS did not 
specify how publicly traded companies 
were any less of a Fraud risk than 
companies that are not publicly traded. 
Several commenters suggested this 
distinction was arbitrary and without 
merit. One commenter stated that being 
publicly traded does not offer immunity 
from risk, and that having one set of 
standards for all providers will make it 
easier for governments, providers and 
consumers to identify and address fraud 


and abuse. One trade association argued 
that it preferred an approach that would 
elevate its members into a higher risk 
screening level than to distinguish 
among its members based upon whether 
a particular entity was publicly traded. 
Another commenter suggested that CMS 
withdraw its proposal; and requested 
that if CMS decides to implement it, it 
should provide the data analysis it used 
in creating this policy choice and 
explain why large privately held 
companies are a greater risk than 
publicly traded companies, 

Response: We agree with the 
arguments the commenters made 
regarding distinguishing among 
screening levels based on a provider or 
supplier's publicly traded status, and 
thus we have eliminated the distinction 
between publicly traded and non- 
publicly traded companies for purposes 
of the screening levels. While it has 
been our general experience that 
publicly traded companies have not 
posed the elevated risk of fraud, waste 
or abuse as non-publicly traded 
companies, we do not believe the risk 
differential between publicly traded and 
non-publicly traded entities is such as 
to warrant the automatic assignment of 
the former into a lesser screening level. 

Comment; Similar to the distinction 
between publicly traded versus non- 
publicly traded, several comments 
suggested that the distinction between 
government-owned or affiliated versus 
non-government owned or affiliated 
ambulance service suppliers was not 
based on any evidence. One commenter 
stated that CMS furnished little or no 
supporting data for the position that 
publicly owned companies pose less of 
a risk. Another commenter contended 
that this distinction presented 
challenges that would make it difficult 
for states to operationalize. Another 
commenter believes that the distinction 
is arbitrary, and noted that private 
ambulance companies are, like public 
companies, held to the same strict 
standards, such as the need for them 
and their personnel to be State-licensed. 
The commenter added that there is no 
evidence to support the assertion that 
private ambulance services pose a 
greater risk of fraud, waste or abuse than 
public companies, and that the OIG 
report referred to in the proposed rule 
entitled “Medicare Payments for 
Ambulance Transports” (OEI-O5-02- 
000590) did not single out private 
ambulance services as posing such a 
risk. Another commenter was concerned 
that assigning private ambulance 
companies to a higher screening level 
could put them at a competitive 
disadvantage vis-a-vis their public 
counterparts. 
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Response; We disagree that this 
distinction would be difficult to 
operationalize. The enrollment process 
generally captures information on the 
supplier’s ownership; this enables 
contractors and States to distinguish 
between government-owned and non- 
government owned entities. However, 
we do agree with the arguments made 
regarding the use of public ownership as 
a criterion for making a distinction in 
the level of screening as determined by 
the risk of fraud, waste or abuse posed 
to the programs, and we have 
eliminated the distinction between 
government-owned and non- 
government owned ambulance 
companies for purposes of the screening 
level assignments. The available 
evidence does not suggest that the risk 
differential between government-owned 
and non-government owned ambulance 
companies is such as to warrant the 
automatic placement of the former into 
a lower screening level. Moreover, we 
note that the ACA requires levels of 
screening according to the risk of fraud, 
waste and abuse posed by categories of 
providers and suppliers. The approach 
taken in this final rule with comment 
period whereby we assign specific 
categories of providers and suppliers to 
screening levels determined by a 
categorical assessment of the risk of 
fraud, waste or abuse to the programs — 
rather than assessing individual's risk — 
is consistent with the requirements of 
the statute. While we believe that a 
more nuanced and precise approach for 
classifying specific categories of 
providers and suppliers into screening 
levels, for example using a scoring 
algorithm to create categories, could 
also be consistent with the statute under 
certain circumstances and were we able 
to provide an adequate rationale for the 
classiHcation, we do not yet have 
experience with such an approach, and 
are therefore finalizing an approach 
based on classifications by entire 
provider and supplier types, We may 
consider additional classifications in 
future rulemaking. 

Comment; A commenter supported 
QMS’s designation of provider fraud and 
abuse risk into three levels for Medicare, 
Medicaid, and CHIP providers, and 
stated that CMS appropriately assigned 
hospitals (including critical access 
hospitals) to the limited level. 

Response; We appreciate this 
commenter’s support. 

Comment: A commenter expressed 
support for QMS’s proposal to move a 
provider type from one screening level 
to another only if it has been found by 
CMS to pose more or less of a fraud and 
abuse risk. However, the commenter 
suggested, that CMS: (1) Review a 


provider class over pre-prescribed time 
periods (for example, 24 months}, and 
(2) allow sufricient time for the provider 
community to offer comment prior to 
changing a provider’s screening level. 

Response: Our proposal to reassign 
providers or suppliers or provider or 
supplier types to another level of 
screening was based on changes in 
circumstances thM contribute to the risk 
of fraud. We believe that to restrict 
ourselves to reassigning providers and 
suppliers only at specific, pre-defined 
time intervals would not provide us 
with the flexibility we need to quickly 
address emerging program integrity 
risks. If a situation arose where there 
was an immediate risk of fraud that 
required the imposition of enhanced 
screening procedures, we must be able 
to deal with it rapidly, rather than wait 
until a particular prescribed time 
interval arrives. We will periodically 
reexamine screening level 
classifications for provider and supplier 
categories. Should a change in a 
particular provider or supplier type’s 
assignment be warranted and should it 
necessitate a change in existing 
regulatory language, we will publish 
notice of the change in the Federal 
Register. 

Comment: A commenter expressed 
support for CMS’ inclusion of 
physicians, non-physician practitioners, 
and medical groups or clinics in the 
limited screening level. The commenter 
stated that these suppliers submit the 
CMS-655I to enroll in Medicare and are 
subject to ail of the penalties listed in 
Section 14 ofCMS-8551 regarding 
falsifying information. 

Response: We appreciate the 
commenter’s support. 

Comment: A commenter requested 
that CMS consider moving CMHCs and 
CORFs from the “moderate” screening 
level to the “limited” screening level. 
With respect to CORFs, the commenter 
stated that CMS’ studies regarding 
program integrity concerns have been 
limited to the State of Florida, and 
contended that it is arbitrary to 
extrapolate that experience to the rest of 
the country. 

Response; We disagree with the 
commenter’s assessment of the risk of 
fraud associated with CMHCs and 
CORFs. These risks extend beyond any 
single region of the country. As a result 
we have decided to keep these provider 
types assigned to the moderate level of 
screening. We believe that the 
assignment of CMHCs and CORFs into 
the moderate screening level was 
appropriate based on the information 
we presented in the proposed rule. 

Comment: A commenter expressed 
support for background checks and 


fingerprinting, but requested that they 
be limited to only providers and 
suppliers assigned to the high risk level 
because of the potential administrative 
burden. 

Response: The final rule with 
comment period is clear that 
fingerprint-based criminal background 
checks are only applicable to providers 
and suppliers assigned to the high 
screening level. 

Comment: A commenter stated that 
CMS, in listing various provider types 
and the levels of risk into which they 
were assigned, did not provide the 
documentation on which it based its 
conclusions, therefore violating the 
Administrative Procedure Act. The 
commenter recommended that CMS 
furnish the following information by 
provider/supplier type to justify its 
conclusions and to inform the public as 
to why certain providers are a limited 
risk to the Medicare program: (l) 

Number of Medicare revocations; (2) 
number of Medicare deactivations; (3) 
Medicare payment suspensions; (4) 
Medicare civil monetary penalties; (5) 
OIG mandatory exclusions; (6) DIG 
permissive exclusions; (7) indictments: 
and (8) felony convictions, 

Response; We based our risk 
assessments on a variety of factors, 
including some of those listed by the 
commenter. as well as others. However, 
because our conclusions were not based 
on any one factor nor any specific 
combination of factors, but rather on 
QMS’s aggregate experience with each 
provider and supplier type, providing 
the data requested by the commenter 
would not serve to clarify the 
determinations of risk. 

Comment: Several commentars stated 
that CMS did not describe how it will 
screen providers and suppliers with a 
designated "other” category, or which 
types of providers and suppliers fall 
within this category and how many 
there are. One commenter stated that 
providers and suppliers in the “Other” 
category should Se assigned to the high 
risk level. 

Response; The “other” category is 
largely reserved for future situations in 
which a statute is enacted that 
authorizes a particular provider or 
supplier type to bill the Medicare 
program; it is designed as a placeholder 
of sorts pending the revision of the 
CMS-055 application to accommodate 
the new provider or supplier type. Since 
we cannot predict which new provider 
or supplier types may be able to bill 
Medicare in the future, we are unable to 
assign them to a particular screening 
level in this final rule with comment 
period. 
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Commeni; Several commenters stated 
that CMS did not explain which risk 
level outpatient physical therapy/ 
occupational therapy (PT/OT), speech 
pathology, and rehabilitation agencies 
would fall into. 

Response: We received a number of 
comments on this issue. We will assign 
occupational therapists, speech 
language pathology, and rehabilitation 
agencies to the “limited" level of risk 
because we do not have evidence of 
program integrity risk that suggest that 
these entities should be assigned to the 
moderate or high levels of screening. 
However, we will assign physical 
therapists (including physical therapy 
groups) to the moderate screening level. 
We believe this classification is 
supported, in part, by a recent OIG 
report entitled “Questionable Billing for 
Medicare Outpatient Therapy Services” 
(December 2010) [bttp://aig.hhs.gov/oei/ 
reports/oei-04-09-00540.pdf], which 
found, among other things, that Miami- 
Dade County had three times, and 
nineteen other counties had at least 
twice, the national level on five of six 
questionable billing characteristics. Law 
enforcement has also identified 
fraudulent billing schemes involving 
phpical therapy. 

Comment; One commenter stated that 
CMS did not describe how it would 
screen new providers or suppliers types 
permitted to enroll in Medicare. Since 
CMS excluded these providers and 
suppliers from its discussion, the 
commenter recommended that these 
entities be considered a high risk. 

Response: Since we cannot predict 
which new provider or supplier types 
may be able to bill Medicare in the 
future, we are unable to assign them to 
a particular screening level in this final 
rule with comment period. When such 
entities emerge, we will make an 
appropriate determination based on the 
data sources we have already described 
in this final rule with comment period, 
as to what screening level assignment is 
most appropriate for such new entities. 
As previously discussed, we will 
publish notice of these new provider 
category assignments in the Federal 
Register prior to making final any such 
assignment. 

Commenf; One commenter 
recommended that non-physician 
owned medical facilities and groups be 
considered a higher risk than physician- 
owned medical facilities, 

flesponse; In the proposed rule, we 
solicited comments on whether non- 
practitioner owned facilities and 
suppliers should be subject to a higher 
level of screening than practitioner- 
owned facilities and suppliers. We 
received several comments suggesting 


that the former category should be 
subject to higher screening than the 
latter. We are declining to adopt this 
suggestion in this final rule with 
comment period, however. As 
previously stated, the ACA requires 
levels of screening according to the risk 
of fraud, waste and abuse posed by 
categories of providers and suppliers. 
The approach taken in this final rule 
with comment period whereby we 
assign specific categories of providers 
and suppliers to risk levels that 
determine screening requirements — 
rather than determining individual 
risk — is consistent with the statute. 

Comment; Several commenters stated 
that extending the enhanced screening 
requirements to MAOs will prove 
duplicative and unnecessarily increase 
costs for providers. Identifying those 
providers participating in multiple 
health programs and coordinating their 
screening and monitoring could, the 
commenters contended, avoid 
unnecessary administrative burden for 
all involved. Otherwise, by extending 
the screening requirements to MAOs, 
providers will be forced to undergo the 
same screening process multiple times, 
for each MAO with whom they contract. 
One commenter stated that It would be 
more efficient for CMS and the States to 
perform the screenings and make that 
data available to the MAO plans through 
a centralized process. Ano^er 
commenter recommended that 
fingerprinting and background checks 
be restricted to State and Federal law 
enforcement agencies, adding that there 
is no legitimate purpose for MA or 
Medicare managed care plans to collect 
and maintain this information. 

Another commenter opposed 
applying the proposed requirements to 
MAOs and other managed care 
organizations (MCOs) for several 
reasons. First, there are already 
appropriate screening tools for MAOs 
for their providers and suppliers 
pursuant to § 422.204(b)(3). Second, 
MAOs have other requirements, as 
established in § 422.204. to access 
certain data bases to verify licensure, 
licensure sanctions and other 
limitations. Third, traditional Medicare 
has a greater population to serve and a 
wider network of providers and 
suppliers to process and screen than 
individual MA plan networks. 

Therefore, the processes should stem 
from those with oversight and 
administration of traditional Medicare, 
with a trickledown effect and benefit for 
MAOs. Fourth, if a limited, moderate or 
high risk provider has an enrollment 
verification letter from Medicare issued 
after March 25, 2011, the provider has 
been appropriately credentialed and 


needs no further credentials for a MAO. 
Fifth, Medicare’s enrollment application 
captures certain elements that are not 
currently captured by some insurers' 
enrollment applications, such as 
delegated representative, authorized 
representative, and owners. This 
information would be difficult to 
capture and verify, and the workload 
would increase substantially on the part 
of MCOs to credential numerous 
individuals who may not have a 
significant role within the providers/ 
supplier entity, 

flesponse; Because there are a large 
number of other regulatory provisions 
that form the framework for oversight of 
managed care plans, and we do not 
want to duplicate these requirements by 
imposing additional screening and 
enrollment criteria on these 
organizations, we have decided not to 
apply the provisions of this final rule 
with comment period to managed care 
plans and organizations. 

Comment; A commenter stated that 
MCOs design their anti-fraud initiatives 
based on the risks they encounter, 
which may be unique and different from 
the risks faced by FFS programs. 
Consequently, CMS should give MCOs 
the flexibility to decide whether to 
adopt any of the proposed new 
screening requirements and, if so, how 
to do so; CMS should not extend the 
screening requirements to MCOs. The 
commenter stated that MCOs should be 
allowed to; (1) Assign providers and 
suppliers to a level that is higher or 
lower than the level assigned by 
Medicare FFS or the State FFS Medicaid 
programs, and (2) deem a provider as 
Having satisfied its screening 
requirements if the provider is enrolled 
in Medicare FFS and/or a Medicaid FFS 
program, and has gone through their 
screening procedures. 

Response; As explained previously, 
we are concerned that the application of 
the screening provisions to MCOs 
would duplicate existing oversight and 
regulatory authority, We therefore have 
decided not to apply the provisions of 
this final rule with comment period to 
managed care plans and organizations. 
This will, as the commenter suggests, 
allow MCOs to develop provider 
screening requirements that are unique 
to their circumstances, including (l) 
assign providers and suppliers to a level 
that is higher or lower than that 
assigned by Medicare or the Stale 
Medicaid program, and (2) deem a 
provider as having satisfied their 
screening requirements if the provider is 
enrolled in Medicare and/or a State 
Medicaid program. 

Comment: A commenter stated that 
applying consistent risk management 
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practices throughout an organization 
fosters a culture of program integrity. As 
such, the commenter recommended that 
MAOs be required to implement the 
same enhanced screening processes that 
CMS is considering for the original 
Medicare program. 

Response: As mentioned earlier, we 
have decided not to apply the 
provisions of this final rule with 
comment period to managed care plans 
and organizations. 

Cominent: A commenter 
recommended that CMS explain what 
type of screening process will be used 
for Medicare Advantage, managed care 
organizations or health maintenance 
organizations. 

Response: As previously stated, there 
are a large number of other regulatory 
provisions that form the framework for 
oversight of managed care plans. We do 
not want to duplicate these 
requirements by imposing additional 
screening and enrollment criteria on 
these organizations. We therefore have 
decided not to apply the provisions of 
this final rule with comment period to 
managed care plans and organizations. 

Comment: A commenter 
recommended that CMS establish 
screening criteria for slide preparation 
facilities and competitive acquisition 
program/Part B vendors. 

Response: We will not be establishing 
screening criteria or prescribing 
screening levels for slide preparation 
facilities in this final rule with comment 
period. Slide preparation facilities do 
not enroll in Medicare at this time; thus, 
we do not believe it is appropriate to 
assign a level of screening to such 
entities. As for competitive acquisition 
program/Part B vendors, these will be 
assigned to the limited screening level. 

It has not been our experience that this 
supplier type poses an elevated risk of 
fraud, waste or abuse to the Medicare 
program. 

In addition, we are adding portable x- 
ray suppliers to the moderate screening 
level. In support of this classification, 
we note that the OIG has analyzed 
Medicare claims data to identify 
suppliers with questionable billing 
patterns. The unusual claims patterns 
that were found raise concerns about the 
integrity of payments to certain portable 
x-ray suppliers. Based on this, and 
combined with the fact that there are 
low barriers to entry for this type of 
supplier, portable x-ray suppliers will 
be placed in the moderate screening 
level. 

Comment; A commenter 
recommended that CMS establish higher 
levels of screening when: (1) A provider 
or supplier changes ownership on a 
frequent basis; (2) a physician or non- 


physician practitioner is enrolled in 
different States; (3) a physician has a 
large number of reassignments or when 
reassigrunents cross States; (4) a 
physician is engaging or billing in a 
reciprocal billing or locum tenens 
billing arrangement: (5) owners have 
businesses in different States; and (6) 
when owners establish banking 
relationships in different States from 
where their practice is located. 

Response: In the proposed rule, we 
sought comment on what Actors should 
permit us to elevate an individual 
provider or supplier to a higher level of 
screening. We appreciate the 
commenter's suggestion. While we are 
not adopting these recommendations at 
this time, such suggestions may form 
the basis of future rulemaking. We 
would first like to evaluate how the 
factors we will finalize as part of this 
rule will work prior to adopting new 
factors such as the ones the commenter 
has identified. 

Comment; One commenter 
recommended that CMS assign to the 
higher screening level any owner or 
physician who had an final adverse 
action within the previous 10 years; has 
an unrepaid overpayment with 
Medicare. Medicaid or CHIP; has a 
Medicare or Medicaid payment 
suspension; exclusion or debarment; a 
felony conviction; unpaid taxes; or a 
Medicare revocation. Another 
commenter stated that in Table 1, CMS 
appears not to consider previous 
payment suspensions, overpayments, 
OIG exclusions, or Medicare revocations 
in establishing higher risk levels. The 
commenter recommended that CMS 
explain why such actions are not an 
indicator of higher program risk and the 
need for enhanced screening. 

Response: As in the proposed rule, we 
state in § 424.518(c) of the final rule 
with comment period that a provider or 
supplier will be moved from the 
“limited” or “moderate” category to the 
“high” level if it has been excluded by 
the OIG, or has had its Medicare billing 
privileges revoked in the previous ten 
years. We have added in the final rule 
with comment that a provider or 
supplier that has been subject to any 
final adverse action as defined at 
§ 424.502 would also be moved to the 
high level of screening. With regard to 
these commenters' other proposals, we 
are generally supportive of them, and 
may examine the possibility of future 
rulemaking to include some of them as 
factors that may elevate a provider or 
supplier to a higher level of risk. As 
previously mentioned, however, we 
would first like to evaluate how the 
factors we will finalize as part of this 


rule will work prior to adopting new 
factors. 

Comment; A commenter 
recommended that CMS propose a 
definition for the term “tax 
delinquency.” as it is used in Table 1 of 
the proposed rule, and clarify whether 
the term refers to Federal, State and/or 
local taxes. 

Response: We have removed tax 
delinquency from the list of database 
checks in this final rule with comment 
period. Though we do have new 
authorities to obtain tax information as 
part of ACA and other recently enacted 
statutes, we are not prepared to 
operationalize this provision at this 
time. 

Comment; A commenter stated that 
CMS’ categorical risk approach did not 
address the individual risk associated 
with certain owners and individual 
practitioners. The commenter 
recommended that CMS issue a new 
proposed rule to establish specific risk 
factors would increase/decrease a 
provider or supplier’s screening level, 

Response; Tne ACA requires levels of 
screening according to the risk of fraud, 
waste and abuse posed by categories of 
providers and suppliers. The approach 
taken in the final rule with comment 
period whereby we assign specific 
categories of providers and suppliers to 
screening levels determined by risk of 
fraud, waste and abuse is consistent 
with the requirements of the statute. 
Furthermore, we believe the approach 
taken in this final rule with comment 
period is objective and allows us to 
avoid subjective assessments of a 
provider's or supplier's risk to the 
programs. 

Comment: A commenter supported 
the use of background checks to ensure 
the identity and integrity of owners and 
senior managers of home health and 
hospice agencies. While supporting the 
maintenance of the confidentiality of 
this information, the commenter 
believes it should be used to; (1} Target 
agencies for special oversight, (2) alert 
owners of patterns of criminal behavior 
on the part of their managers, and (3) 
disqualify owners or managers that have 
criminal histories. 

Response: We intend to use this tool 
in a way thet safeguards personal 
information and also helps prevent 
fraud, waste and abuse, The criminal 
history record will verify whether a 
provider, supplier, or an individual 
with a 5 percent or greater direct or 
indirect ownership interest in such 
provider or supplier has been convicted 
of certain types of felonies that could 
result in the denial or revocation of 
billing privileges under §424.530 or 
§ 424.535, respectively, We believe that 
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criminal history record checks will 
confirm the accuracy of information 
submitted in enrollment applications, 
and the discovery of false or misleading 
information could result in denial or 
revocation of billing privileges under 
§ 424.530 or § 424,535. Providers or 
suppliers who have been denied on 
these bases are afforded all applicable 
appeals rights. 

While in some instances, such a 
denial may result in alerting a provider 
or supplier of an individual’s criminal 
history, this is not the purpose or 
intention of this enrollment screening 
tool, Rather we will use this authority 
for the purpose of verifying eligibility 
for Medicare enrollment. We will 
disseminate guidance and instructions 
to providers, suppliers and our 
enrollment contractors shortly after the 
publication of this final rule with 
comment period regarding the 
implementation of the criminal history 
record check requirement. 

Comment: A commenter opposed the 
proposal to move those who have 
previously been placed on a payment 
suspension or subject to a denial or 
revocation in the past year, into a higher 
screening level. The commenter stated 
that a payment suspension may be 
imposed upon a mere or false suspicion 
of wrongdoing, and that the denial or 
revocation could have been based on an 
innocent mistake. 

Response.' We agree with this 
commenter with respect to the denial of 
billing privileges. Many denials occur 
simply because the provider does not 
meet requirements to enroll as a 
particular provider type or other clerical 
errors. We have therefore removed the 
denial of billing privileges as a basis for 
moving a provider or supplier into a 
higher risk screening level. We have 
retained revocations of Medicare billing 
rivileges as such a basis because we 
elieve that such a provider poses a 
heightened risk of fraud, waste or abuse 
to the Medicare Trust Fund. 

Payment suspension is used as a baud 
fighting tool only in instances where 
facts available point to possible fraud, 
waste, or abuse. Consequently, because 
of the risk to the program posed by 
individuals and entities upon which a 
payment suspension has been imposed, 
we believe we are justified in placing 
them in the high risk screening level. 

CojTunenf.-One commenter suggested 
that in lieu of fingerprinting, each 
owner or physician should submit: (1) A 
U.S, Passport or a Foreign Passport with 
their enrollment application, and/or (2) 
copies of their Federal Tax Returns. 

Response.- We agree with the 
commenter that there may be 
alternatives to fingerprint-based 


criminal history record checks to verify 
identity; however information on U.S. 

OF foreign passports and Federal Tax 
Returns, such as name, date of birth and 
Social Security number are duplicative 
of information that is captured in the 
Medicare enrollment application. 
Information that would be obtained 
from a U.S. or foreign passport or 
Federal Tax Returns could only be used 
to process a name-based criminal 
history record check, and the FBI does 
not process name-based requests for 
non-criminal justice purposes. The 
submission of fingerprints is the only 
way to obtain a criminal history record 
check from the FBI. 

Additionally, the National Task Force 
on the Criminal Backgrounding of 
America concluded that fingerprint- 
based criminal history record checks are 
more accurate than name-based checks 
because “names tend to be unreliable 
because: people lie about their names; 
obtain names from false documents; 
change their names; people have the 
same name; people misspell names; 
people use different versions of their 
names * * • people use aliases * * * ” 
The suppliers assigned to the high 
screening level have been so assigned 
because, in CMS, and its law 
enforcement partners' experience, such 
supplier types have, as a category, not 
undergone sufficient scrutiny in the 
enrollment process. Some may have 
gained entry in the past through 
falsification of an enrollment 
application that may have passed a 
name based check. As a result, the extra 
level of screening provided by the 
submission of fingerprints for the 
purposes of an FBI database check has 
the potential to deny enrollment to 
individuals whose sole intent is to 
defraud the Medicare program. We 
believe fingerprint-based criminal 
history record checks will be an 
effective tool to prevent fraud, waste, 
and abuse in Federal health care 
programs by independently verifying 
information provided on applications of 
potential providers and suppliers in the 
high screening level. 

If, after a sufticient period of 
evaluation, we conclude that 
fingerprint-based FBI criminal history 
record checks do not fulfill our program 
integrity objective of identifying 
applicants who pose a heightened risk 
of fraud, waste, and abuse prior to 
enrollment or we determine that 
supplementary actions are needed, we 
may pursue additional rulemaking that 
seeks to adopt alternative or additional 
safeguards consistent with authorities 
given to the Secretary in the ACA. 

Comment: A commenter stated the 
screening process described by CMS 


does little to ensure that a provider or 
supplier is submitting legitimate claims 
for eligible individuals, since there is no 
linkage between the enrollment process 
and claim submission process. The 
commenter contended that it did not 
appear that CMS considered the 
alternative approach of linking its 
proposed screening requirements to 
section 1866{j)(3) of the Act. The 
commenter recommended that CMS 
establish a link between the screening 
process and the payment process by 
establishing payment caps and 
prepayment claims review as described 
in section 1866(j)(3) of the Act. 

Response; The commenter references 
new section 1866{j)(3) of the Act, which 
addresses a provisional period of 
enhanced oversight for new providers or 
suppliers of services. We believe that 
the payment caps and prepayment 
claims processes should supplement, 
but not be used in lieu of, the 
procedures outlined in this proposed 
rule. Payment caps and prepayment 
claims processes will be addressed in 
separate vehicles. Clearly, the 
provisions of section 1866(j)(3) of the 
Act are an important complement to the 
pre-enrollment screening provisions in 
this rule. We intend to use both to fight 
fraud. However, this provision is not 
part of this final rule with comment 
period. In fact, the ACA authorizes the 
Secretary to implement the provisions 
of section 1866ij){3) of the Act through 
instruction or otherwise. 

Comment: A commenter contended 
that with respect to the limited risk 
screening requirements, the language in 
proposed §424,518{a)(2Ki) may be 
overly broad. The commenter believes 
the intent of this provision is for the 
contractor to verify that the provider or 
supplier meets only the applicable 
regulations or requirements that qualify 
it for the appropriate provider or 
supplier type. However, the commenter 
stated that, as written, §424.518(a](2)(i} 
could be construed to require the 
Medicare contractor to verify the 
provider or supplier's compliance with 
virtually every Federal regulation and 
State requirement that applies to the 
provider or supplier type. This, the 
commenter argued, could subject 
limited categorical risk providers and 
suppliers to an overly broad, 
burdensome, and time-consuming 
verification process. 

Response: As explained in the 
proposed rule, the verification process 
for limited risk providers and suppliers 
will be that which is currently used for 
most providers and suppliers. The 
verification will be limited to 
enrollment requirements, and will not 
examine compliance with all other State 
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and Federal regulations unless the other 
State and Federal regulations have an 
impact on whether the provider or 
supplier meets the requirements for 
enrolling or revalidating enrollment in 
Medicare. T^e table that describes the 
types of screening to be performed for 
each of the three screening levels 
explains clearly the kinds of verification 
processes that CMS contractors will be 
using to verify a provider’s or supplier’s 
eligibility to enroll or remain enrolled in 
Medicare. 

Comment; One commenter requested 
that CMS explain why it did not 
consider compliance plans in 
establishing its screening criteria. 

Response: We solicited comments 
regarding the use of compliance plans in 
combating fraud, waste, and abuse. 
Because there are a several complex 
policy and implementation issues we 
are pursuing separate additional 
rulemaking in this area. 

Comment: One commenter stated that, 
CMS did not include a discussion of 
low quality of care when it established 
its screening criteria. 

Response; Quality of care is the 
subject of several other CMS 
regulations. Accordingly, we did not 
include quality consideration in our 
development of levels of categorical 
screening. We believe that the factors 
we included in the proposed rule for 
establishing the screening criteria 
support our classifications. 

Comment; A commenter 
recommended that CMS increase the 
level of screening for any provider using 
a billing agent or clearinghouse 
convicted of health care fraud. The 
commenter also recommended that, 
similar to the provisions found In 
section 6503 of the ACA, CMS establish 
enrollment standards for clearinghouses 
and billing agents for Medicare. CMS, 
the commenter stated, mentioned In the 
proposed rule that "based on our data 
analysis including analysis of historical 
trends and CMS’ own experience with 
provider screening and enrollment we 
believe the following providers and 
suppliers pose a limited risk.” The 
commenter also recommended that CMS 
furnish the data analysis used to assign 
each provider type in the limited 
screening levels and the moderate 
screening levels. 

Response; As for the commenter’s 
recommendation regarding billing 
agents and clearinghouses, the 
commenter references section 6503 of 
ACA, which calls for billing agents and 
clearinghouses to register under 
Medicaid. The implementation of 6503 
of the ACA, is not part of this rule; 
however, we will be addressing that 
provision in the future, We do not 


propose to screen billing agents and/or 
clearinghouses as part of this rule 
because such entities do not enroll in 
Medicare as providers or suppliers. 

With respect to the data analysis we 
used, we furnished information in the 
proposed rule regarding our reasons for 
assigning certain provider and supplier 
types to limited, moderate or high level 
of screening. We relied on our 
experience to identify categories of 
providers with a higher incidence of 
fraud as well as our ^miliarity with 
types of fraudulent schemes that are 
currently prevalent in Medicare. In 
addition, we used the expertise of our 
contractors charged with identifying 
and investigating instances of 
fraudulent billing practices in making 
our decisions regarding the appropriate 
risk assessment of various providers. In 
some instances, we also relied on the 
data analysis and expertise of the OIG, 
Gao, and other sources to develop 
screening levels designed to increase 
scrutiny for specific categories of 
providers and suppliers as the risk 
posed to the Medicare and Medicaid 
programs increases. 

Comment; A commenter asked 
whether CMS, in grouping all hospital 
types — including specialty hospitals, 
physician-owned hospitals, short-term 
hospitals, and acute hospitals — into one 
risk level, is stating that all hospitals 
have the same risk. If so. the commenter 
requested that CMS provide data to 
support this assertion and to explain 
why it believes that all hospitals pose 
the same risk 

Response; Our assignment of 
hospitals to the limited screening level 
should not be construed as meaning that 
every type of hospital poses the same 
exact degree of risk. We did. however, 
base our assignment on the premise that 
all hospital provider types have certain 
features in common that make them less 
likely to be a program integrity concern 
on the whole. For example, such entities 
have significant start up costs and 
capital and infrastructure costs. In 
addition, such entities are subject to 
significant government oversight, at 
both the State and Federal levels. 
Finally, such entities often are subject to 
oversight from other accrediting bodies 
throu^ deeming authority. These 
features are, in general, less apparent 
with other provider and supplier types. 
We note that these are not the only 
features we considered when evaluating 
hospitals and that these features, by 
themselves, are not sufficient to cause 
us to place a provider or supplier type 
in the limited screening category. 

Comment: A commenter stated that in 
Table 1, CMS appears not to consider 
previous payment suspensions. 


overpayments, OIG exclusions, or 
Medicare revocations in establishing 
higher risk levels. The commenter 
recommended that CMS explain why 
such actions are not an indicator of 
higher program risk and the need for 
enhanced screening. 

Response: As mentioned previously, 
we state in this final rule with comment 
period that a provider or supplier will 
be placed into the high screening level 
if the provider or supplier (or an 
individual who maintains a 5 percent or 
greater direct or indirect ownership 
interest in such provider or supplier) 
has had a final adverse action — as that 
term is defined in § 424.502 — imposed 
against it within the previous 10 years. 

Comment; A commenter stated that 
because of the wide variation in 
DMEPOS items and services and 
differing levels of behavior. CMS should 
subdivide the general category of 
DMEPOS suppliers and assign 
appropriate screening levels to each 
product category, rather than to 
DMEPOS suppliers as a whole. 

Response; We think the commenter's 
suggestion might lead to an overly 
complex system of provider screening 
and related oversight tools. Accordingly, 
we have decided not to create such a 
distinction based on such sub- 
categories. At this time, we are not 
determining the risk of fraud, waste, and 
abuse by product category. 

Comment; Several commenters 
requested CMS to change the proposed 
rule to state that both publicly traded 
entities and their wholly-owned 
subsidiaries are afforded “limited 
categorical risk” status. 

Response; As stated previously, 
publicly traded status is not being 
included as a criterion for assigning 
provider or supplier categories to 
screening levels. The approach taken in 
this final rule with comment period 
whereby we assign specific categories of 
providers and suppliers to screening 
levels determined by the categorical risk 
of fraud— rather than determining 
individual risk — is consistent with the 
requirements of the ACA. 

Comment: One commenter supported 
CMS's proposal to place new HHAs into 
the high screening level. The 
commenter stated that much of the 
fraud and abuse that has been detected 
in the home health benefit is associated 
with new providers, particularly in 
areas not subject to certificate of need 
(CON) or other State controls on 
provider development, 

Response; We appreciate this 
commenter’s support. 

Comment; One commenter 
recommended that the proposed rules 
for assigning screening levels for 
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existing home health and hospice 
providers be modified so as to more 
accurately focus enforcement efforts on 
certain existing providers within a 
particular category. More specifically, 
the commenter stated that CMS can use 
its ample data resources to more 
precisely differentiate between agencies 
with proven histories of good 
performance and those that are either 
untested or have demonstrated irregular 
patterns of performance. The 
commenter recommended that any 
nonprofit home health or hospice 
agency that was certified in Medicare or 
Medicaid before October 1, 2000, and 
has not been identified as having 
program integrity problems, be placed 
in the limited risk screening level. The 
commenter added that CMS should also 
create a scoring algorithm that would 
identify those HHAs and hospices at 
moderate risk based on criteria such as: 
(1) Years of program participation; (2) 
ownership type; (3) number of medical 
review requests; (4) pattern of 
selectively serving highly profitable 
cases: (5) frequent changes in 
ownership; (6) geographic location; (7) 
relationship to other stable (for example, 
hospital] or less stable provider types 
(DMEPOS); and (8) current accreditation 
status. 

Response: We did not base our 
development of levels of screening on 
provider-specific risk assessments. As 
described previously, the statutory 
requirements set forth in ACA guided 
our approach in assigning categories of 
providers and suppliers to screening 
levels appropriate to the risk of fraud, 
rather than pre-screening individuals 
prior to the assignment of a screening 
Jevel Adopting the type of scoring 
algorithm suggested by the commenter 
would automatically provide for 
Individual breakdowns of each HHA’s 
or hospice's risk, which we believe 
would be inconsistent with the statute 
and constitute a pre-screening step in 
the enrollment process. We do not nils 
out the possibility of using scoring 
algorithms in the future for other 
program integrity functions or for 
provider and supplier enrollment, but 
we decline to adopt this suggestion for 
enrollment screening purposes at this 
time. For the reasons stated previously, 
we believe that the moderate risk 
screening level is appropriate for 
currently enrolled HHAs and hospices. 

Comment: A commenter did not 
believe that site visits were necessary to 
ensure that ambulance providers and 
suppliers were in compliance with 
applicable program requirements. The 
commenter expressed concern that the 
time associated with conducting pre- 
enrollment site visits could slow down 


the enrollment process. The commenter 
added that ambulance services are 
already subject to site inspections by the 
State licensing agency {as well as other 
State and Federal requirements), and 
that the existing procedures are 
sufficient to ensure that ambulance 
providers and suppliers are operating in 
compliance with program requirements. 
Another commenter stated that in this 
proposed rule, CMS states that it only 
conducts a limited number of 
unscheduled or unannounced site visits 
for certain provider types. If this is 
based on a policy decision, the 
commenter requested that CMS explain 
why it now believes that unscheduled 
or unannounced site visits will reduce 
fraud, waste, and abuse. The commenter 
also requested a cost/benefit analysis for 
its previous onsite efforts to show the 
effectiveness of this new strategy. If a 
fiscal constraint, the commenter 
requested that CMS explain: (1) Why it 
is spending $9 million on grants to 
Senior Medicare Patrol (SMP) and 
millions in advertising to promote “Stop 
Medicare Fraud” in lieu of conducting 
unscheduled and unannounced site 
visits, and (2) where the additional 
funds will come from to conduct 
thousands of unannounced site visits. 

Response: We have been conducting 
site visits of one kind or another for 
years, and have found such visits to be 
an extremely effective tool in fighting 
fraud. We plan to conduct site visits 
pursuant to the authorities provided in 
the ACA and as outlined in this final 
rule with comment period. We have 
received many valuable tips and other 
information from SMP volunteers across 
the country. We believe that site visits 
aro appropriate for ambulance 
companies, especially considering that 
we have uncovered several instances 
where an enrolling ambulance 
company — contrary to the information it 
furnished on the CMS-855B — had no 
base of operations. Regarding the 
commenters concern about the Senior 
Medicare Patrol initiative, we believe 
the SMP program is outside the scope of 
this regulation. 

Comment: With respect to whether 
non-practitioner-owned facilities and 
suppliers should be subject to a higher 
level of screening than their 
practitioner-owned counterparts, a 
commenter urged CMS to exempt 
dually-enrolled physicians from 
enrollment screening requirements 
applicable to entities only enrolling as 
DMEPOS suppliers. The commenter 
believes it would make no sense to 
consider physicians "limited risk” while 
simultaneously labeling them either 
“moderate risk” or “high risk" when they 
provide DMEPOS to their own patients. 


Response: We disagree. As stated 
previously, the approach taken in this 
final rule with comment period whereby 
we assign specific categories of 
providers and suppliers to screening 
levels determines by the assessed 
categorical risk of fraud — rather than 
determining individual risk — is 
consistent with the requirements of the 
ACA. We believe that each provider and 
supplier category must be considered on 
its own merits as an entire class, rather 
than be sub-categorized based on 
whether or not a particular provider is 
owned by provider subject to the 
limited screening level. For reasons we 
have stated, both in this final rule with 
comment period and in the past, newly 
enrolling DMEPOS suppliers are 
currently subject to a higher level of 
scrutiny and revalidating DMEPOS 
suppliers are subject to the moderate 
level of screening — such as through the 
need to comply with the supplier 
standards in § 424.57(c) — because of the 
heightened risk posed by this class of 
suppliers as a whole. We therefore 
decline to exempt certain types of 
DMEPOS suppliers from either the 
moderate level of screening for 
revalidating suppliers or the high level 
of screening for newly enrolling 
suppliers. 

Comment: A commenter suggested 
that CMS revise the enrollment 
applications to include language in the 
certiHcation statement so that CMS' 
contractors can conduct a criminal 
background check on any owner, 
authorized official, delegated official, 
managing employees and individual 
practitioners during the initial 
enrollment process or subsequently 
thereafter. The commenter believes that 
CMS is needlessly limiting its ability to 
conduct criminal background checks. 

Response: We appreciate this 
comment but decline to adopt this 
approach. We will perform fingerprint- 
based criminal history record checks of 
the FBI's Integrated Automated 
Fingerprint Identification System 
consistent with the methodology 
specified in this rule. We do not intend 
to amend the CMS-855 to include 
language that would expand the use of 
such criminal history record checks 
beyond the requirements set forth in 
this final rule with comment period. We 
think that to conduct the same screening 
for all provider categories without 
taking into account the variation in risk 
of fraud, waste or abuse would be an 
inappropriate allocation, of resources 
and would be inconsistent with the 
provisions of the. ACA. As stated 
previously, if CMS re-assigns additional 
categories of providers to the high level 
of screening, or expands the use of FBI 
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criminal history record checks to the 
other screening levels, CMS will publish 
a notice in the Federal Register. 

Comment: A commenter suggested 
that Medicare, Medicaid, and CHIP 
consider bankruptcy and credit report 
scores during the screening process and 
that CMS deny enrollment where an 
owner, authorized official, or delegated 
official has a credit score of less than 
720 or has had a personal or business 
bankruptcy within the last 5 or 10 years. 
The commenter stated that credit score 
is indicative a person’s ability to 
manage financial assets. 

Response: We decline to adopt this 
approach in this final rule with 
comment period. We would need to 
perform additional study to determine 
whether credit scores correlate with 
program integrity risk. Because we do 
not have evidence to support such a 
relationship, we decline to adopt this 
roach at this time, 
ommenf; Several commenters 
requested clarification on whether a 
Federal agency or a private company 
will process the fingerprint card, how 
CMS will safeguard this information, 
and how much additional time 
fingerprinting will add to the screening 
process of new applicants. Another 
commenter urged CMS to ensure that 
documentation concerning fingerprints 
be tracked from origination to delivery 
to prevent loss, and that all information 
bejprotected from FOIA disclosure. 

Response: The FBI requires that 
fingerprints be collected and submitted 
by FBI-approved “authorized 
channeiers.” The FBI currently has 
approved 15 such private companies to 
collect and submit fingerprints to the 
FBI CJIS Division’s Wide Area Network 
(WAN), receive the criminal history 
record information, and submit the 
record to authorized recipients, in this 
case CMS (or its FBI approved 
outsourced contractors) for the 
determination of eligibility for 
enrollment. CMS will use of orie or 
more of the pre-approved authorized 
channeiers to collect and submit 
fingerprints directly to the FBI, and 
CMS will ensure the written proposal(s) 
provided by the selected channeler{s) 
contains the appropriate assurances of 
compliance with privacy and security 
considerations mandated by the 
Compact Council (the national 
independent authority that regulates 
and facilitates the exchange of 
noncriminal justice criminal history 
record information) and as required by 
28 CFR part 906. Additionally, CMS 
will adhere to the Compact Council’s 
Security and Management Control 
Outsourcing Standard for Channeiers. 
The use of authorized channeiers 


effectively means CMS never has 
custody of the submitted Fingerprints, 
only the resulting criminal history 
record. CMS will, of course, protect the 
information in the criminal history 
record according to existing Federal 
standards and procedures that govern 
personally identifiable information. 

After further consideration of the 
proposed requirement that all required 
applicants submit their Bngerprints on 
the FD-258 card, CMS has removed the 
requirement to use only the FD-258 
card from this final rule with comment 
period. CMS strongly encourages all 
required applicants to provide 
electronic fingerprints to the CMS- 
selected authorized channeier. but will 
also accept the FD-250 card. As stated 
previously, CMS and the authorized 
channeier will safeguard the 
information as required by the existing 
requirements of the Compact Council, 
and specifically the Compact Council's 
Security and Management Control 
Outsourcing Standard for Non- 
Channelers and Channeiers end the 
FBI’s Criminal Justice Information 
System's Security Policy. 

We believe the additional time for a 
contractor’s processing of the 
application in light of the fingerprint- 
baaed criminal history record check will 
be minimal for those applicants who 
submit electronic fingerprints. 
Applicants who submit the FD-258 card 
will experience an extended processing 
time as the authorized channeier 
selected by CMS will have to convert 
the paper print into a electronic 
submission so that the FBI can quickly 
process all requests. The FBI processing 
of the electronic prints occurs within 24 
hours of receipt from the authorized 
channeier, end the authorized channeier 
will receive and transmit the report to 
CMS. The report will be reviewed for 
disqualifying felonies and omitted 
information as outlined in existing 
regulations at § 424.530(a) for 
enrollment and at §424. 535(a) for 
revalidation and once the fitness 
determination has been made, the 
appropriate contractor will process the 
enrollment application as before. CMS 
believes this process will not causa 
significant delays to the enrollment 
process. 

As stated previously, CMS and our 
Medicare contractors will protect 
individuals’ information under the 
Privacy Act, 5 U.S.C. 552a and the 
Privacy Act system of records notice for 
this information. We recognize that the 
safeguarding of individual privacy and 
ensuring the security of fingerprints 
collected under this regulation is a 
serious concern. We will ensure that 
these concerns are addressed and that 


ail necessary safeguards are 
implemented to protect this information 
-from both privacy and security 
standpoints — when we issue guidance 
on fingerprint-based criminal history 
record checks following the publication 
of this final rule with comment period. 
We will ensure that fingerprint 
documentation is fully protected to the 
extent required by Federal law. 

As stated previously, the fingerprint- 
based criminal history record check will 
be required 60 days following the 
publication of subregulatory guidance. 
All other screening requirements are 
effective on March 25, 2011 for those in 
the “high" screening level. The delay in 
the effective date for the fingerprint- 
based criminel history check will permit 
CMS to coordinate the implementation 
of this new process with our law 
enforcement partners, ensure that all 
concerns related to privacy are 
addressed, educate our providers and 
suppliers about the new process, and 
ensure that our contractors are 
adequately prepared to implement this 
new process so that the implementation 
of this new process does not cause any 
undue delay. 

Commenf; A commenter stated that 
while CMS assigns CMHCs to the 
moderate screening level. CMS has not 
taken steps to implement section 1301 
of the Health Care and Education 
Reconciliation Act of 2010 (collectively, 
the Affordable Care Act), which requires 
that CMHCs provide at least 40 percent 
of its services to individuals who are not 
eligible for benefits, The commenter 
recommended that CMS consider 
CMHCs as a “high" categorical screening 
risk until CMS implements section 1301 
of the ACA, 

Response: For reasons already 
explained, we believe that CMHCs are 
most appropriately assigned to the 
moderate screening level. Section 1301 
of ACA is not a part of this rule. 

Comment: Several commenters 
requested that CMS consider 
establishing criteria for making 
assignments to screening levels before 
moving forward with this rule, 

Response: We explain in the preamble 
the criteria and factors we used for our 
placement of various provider and 
supplier types into particular levels. 
These factors include our experience 
with claims data used to identify 
fraudulent billing practices, as well as 
the expertise developed by onr 
contractors charged with investigating 
and identifying instances of Medicare 
fraud across multiple categories of 
providers. In addition, we have relied 
on insights gained from numerous 
studies conducted by the HHS OIG, 
GAO, and other sources. 
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Comment: A commenter requested 
that a fourth level of “no risk” be 
established. This is to reflect positively 
on providers who have had no incidents 
of fraud, waste or abu,se. 

Response: We do not believe it is 
appropriate to create a “no risk” level as 
the limited level of screening represents 
the baseline screening requirements for 
entry into the Medicare program, We 
believe that fraud, waste and abuse can 
occur at any time and among any 
provider or supplier category. Our 
screening methodology is designed to 
match an appropriate level of screening 
to provider or supplier categories based 
on level of risk of fraud, waste or abuse 
posed by the provider or supplier 
category. 

Comment: A commenter requested 
clarification regarding whether CMS 
will conduct TIN matches with the IRS 
via an automated match or whether the 
provider will be required to sign an I- 
9 verification form. The commenter also 
asked whether CMS will conduct tax 
delinquency database matches with the 
IRS and the authority for such a match. 
In both cases, the commenter 
recommended that CMS establish new 
denial and revocation reasons if the TIN 
does not match or there is a tax 
delinquency. 

flesponse; We currently verify the 
provider’s TIN as part of the enrollment 
process; if the TIN does not match the 
provider’s legal business name, the 
application will be denied, or, if 
enrolled, the provider’s billing 
privileges will be revoked. However, we 
have removed references to tax 
delinquencies as a component of the 
screening methodology from this rule. 
While we do plan to implement 
provisions that will allow us to 
coordinate enrollment decisions with 
data obtained from the Internal Revenue 
Service — for instance, potentially 
denying an application based on tax 
delinquency Information from the IRS — 
such an effort is not a part of this rule. 

Comment; A commenter stated that 
CMS’s proposed “limited risk” 
classification for publicly traded 
companies does not explicitly afford the 
same treatment to subsidiaries of 
publicly traded providers and suppliers. 
Several commenters recommended that 
majority owned subsidiaries of publicly 
traded providers and suppliers be 
treated the same as their publicly traded 
parents. Specifically, since subsidiaries 
of publicly traded providers and 
suppliers are subject to substantially 
similar oversight and scrutiny, the 
commenter proposed that all providers 
and suppliers — jegardless of whether 
the parent is enrolled — that are at least 
majority owned, directly or indirectly, 


by a publicly traded provider or 
supplier be assigned to the limited risk 
level for screening. The commenter 
suggested that proposed §424.S18(a)(2) 
be revised to read as follows: “{2} When 
CMS designates a provider or supplier 
into the "limited” categorical level of 
screening, the provider or supplier is 
publicly traded on the New York Stock 
Exchange (NYSE) or the National 
Association of Securities Dealers 
Automated Quotation System 
(NASDAQ), or the provider or supplier 
is majority owned, directly or indirectly, 
by an organization publicly traded on 
the NYSE or NASDAQ * “ Another 
commenter stated that subjecting 
difrerent providers under a hospital to 
different levels of scrutiny could cause 
confusion and uimecessary hardship. 

Response: For reasons already stated, 
we have eliminated the distinction 
between publicly traded and private 
companies and have declined to 
subcategorize individual providers and 
suppliers based on their ownership. 

Comment: A commenter stated that 
while subjecting newly enrolling 
DMEPOS suppliers to stringent 
screening may be proper, an enrolled 
DMEPOS supplier that reenrolls 
following an ownership change should 
not be subject to the same screening as 
a newly established supplier. It should 
instead be treated as moderate risk, just 
as enrolled suppliers that revalidate 
their enrollment information. The 
commenter contended that the seller's 
business, much of which remains after 
the purchase, has already been verified 
and authenticated; if CMS and the NSC 
subject the purchaser to stringent 
enrollment screening, they will 
duplicate the work that they have 
already done to validate and inspect the 
purchased business, wasting resources. 

It could also delay the new owner's 
receipt of a Medicare number, which 
could disrupt the continuity of business 
and patient care. The commenter added 
that if CMS does not agree that an 
enrollment following an ownership 
change of an enrolled DMEPOS supplier 
should be moderate risk, CMS should 
formally state that purchasers of 
enrolled DMEPOS suppliers will receive 
new Medicare numbers with billing 
privileges retroactive to the purchase 
date, In closing, the commenter stated 
that the proposed rule is a dramatic 
change to the existing methods of 
Medicare enrollment; while change to 
prevent fraud and abuse is advisable, 
such change should not harm honest 
providers and suppliers who strive to 
provide high quality service to Medicare 
beneficiaries. Another comment staled 
the purchaser of an existing community 
pharmacy DME supplier store should be 


screened as a moderate (not a high) risk 
supplier during reenrollment. 

Response; We disagree that a 
DMEPOS supplier undergoing a change 
of ownership should be assigned to the 
as moderate screening level. For 
purposes of enrollment, a DMEPOS 
supplier undergoing a change of 
ownership is treated and must enroll as 
a new supplier. Hence, since all newly- 
enrolling DMEPOS suppliers are subject 
to a “hi^” level of screening, we believe 
DMEPOS suppliers undergoing a change 
of ownership should also be subject to 
a “high” level of screening. Further, the 
screening requirements in the high 
screening level include a fingerprint- 
based criminal history record check of 
any individual with direct or indirect 
ownership of 5 percent or greater. 
Therefore, enrollment screening after a 
change in ownership has clear value to 
the enrollment process, and we disagree 
that it would be a waste of resources. 
Currently-enrolled (revalidating) 
DMEPOS suppliers are assigned to the 
moderate level of screening. 

Comment; A commenter stated that 
certified orthotic and prosthetic 
DMEPOS suppliers and American Board 
for Certification in Orthotics and 
Prosthetics {ABC)-accredited DMEPOS 
suppliers should be assigned to the 
limited screening level. The commenter 
stated that accreditation is not an easy 
standard to meet, and asked CMS to 
investigate whether there are any 
studies or other evidence that indicate 
that ABC Accredited Facilities and/or 
ABC Certified practitioners as a 
DMEPOS subcategory pose an elevated 
risk to the Medicare program. If there 
are not, such suppliers should be 
subject to limited screening. 

Response; We believe the commenter 
is asserting that accreditation bodies 
perform a sufficient level of oversight to 
ensure that the entities they accredit are 
a low program integrity risk. We do not 
believe this is true. The accreditation 
bodies help verify the supplier’s 
compliance with DMEPOS standards, 
rather than assess the supplier’s risk of 
fraud, waste and abuse. Accordingly, we 
decline to assign entities accredited by 
ABC or any other accrediting 
organization to the limited screening 
level solely on that basis. 

Comment; A commenter contended 
that in States without licensure, if a 
DMEPOS supplier is practitioner-owned 
and one or more of the practitioners is 
certified by ABC (accrediting body 
referenced in section 427 of the 
Medicare, Medicaid, and SCRIP 
Benefits Improvement and Protection 
Act of 2000 (BIPA)), or if the facility 
itself has been accredited by one of 
these entities, it should be as assigned 



201 


Federal Register/ Vol. 76. No. 22/Wednesday, February 2, 2011/Rules and Regulations 5881 


to the limited screening level. The 
practitioner being credentialed in either 
of these ways has demonstrated a 
commitment to qualitv- 

flesponse,- As already stated, we 
decline to subcategorize individual 
providers and suppliers based on their 
ownership and do not believe 
accreditation — standing alone — should 
be the foremost indicator of fraud and 
abuse risk. 

Comment: One commenter stated that 
chain pharmacies should be exempt 
from the increased screening levels and 
screening procedures, as they are 
already subject to significant regulation 
within their respective States, 

Response: We disagree. For the same 
reason that we cited for eliminating the 
distinction between publicly traded and 
non-publicly traded or public or non- 
public ownership status as a basis for 
determining screening level, state 
regulation of chain DMEPOS suppliers 
is hot in itself a sufficient indicator of 
the risk of fraud, waste or abuse posed 
by a particular category of provider or 
supplier. The fact that a particular 
provider or supplier type may be 
regulated by the State is not adequate 
grounds for placing it in a lower 
screening level. 

Comment; A commenter stated that 
the proposed provisions punish 
legitimate providers and that the most 
egregious fraud is committed by scam 
artists and organized crime. The 
commenter expressed concern that 
small practices will be driven out of 
business. In light of CMS’s proposed 
exemption for public companies, one or 
two large national companies may be 
the only ones "left standing” and will 
have a monopoly. CMS, the commenter 
argued, will then be unable to 
objectively compare "best practices” or 
to objectively evaluate trends in care, 
and that patients will not have a choice 
for their care. 

Response; As already stated, we have 
eliminated the distinction between 
publicly held and private companias, In 
addition, we believe that the proposed 
provisions will help stem the fraud that 
both the commenter and we are 
concerned about 

Comment: A commenter 
recommended that CMS provide the 
analysis for which it based its risk 
assignment decisions for limited and 
moderate screening levels. The 
commenter also recommended that CMS 
consider the Medicare and Medicaid 
error rates for each provider or supplier 
in establishing its screening levels. 
Finally, the commenter also requested 
the following data for each type of 
Medicare provider and supplier for 
2008, 2009, and 2010: 


• Number of Medicare revocations. 

• Number of Medicare payment 
suspension. 

• Number of Medicare overpayment. 

• Medicare error rate. 

• Medicaid error rate. 

• CMPs. 

• Convictions by the Department of 
Justice. 

• HHS OIG mandatory exclusions 
under 1128 of the Act 

• HHS OIG permissive exclusions 
under 1128 of the Act. 

Response; We based our risk 
assessments on a variety of factors, 
including some of those listed by the 
commenter as well as others. However, 
because our conclusions were not based 
on any one factor nor any specific 
combination of factors, but rather on 
CMS's aggregate experience with each 
provider and supplier type, providing 
the data requested by the commenter 
would not serve to clarify the 
determinations of risk. 

Comment: A commenter stated that 
the proposed screening approach in the 
proposed rule is simplistic at best and 
flawed at worst. The commenter did not 
believe provider type is the only 
measure of risk of fraud. To address 
those individuals and organizations 
who intend to enroll for the sole 
purpose of committing fraud, CMS 
must: (1) Consider the provider’s past 
experience with Medicare, Medicaid, or 
CHIP; (2) coordinate enrollment and 
billing issues with commercial health 
plans, Medicaid and CHIP: and (3) 
establish more stringent program 
requirements. The commenter believes 
that CMS did not offer any enhanced 
program requirements in the proposed 
rule, the rule does not reduce the “pay 
and chase” approach used by CMS and 
OIG today, 

Response: We disagree, and believe 
that the program safeguard measures 
outlined in this final rule with comment 
period will greatly assist in reducing 
fraudulent activity. We believe several 
of the elements proposed by the 
commenter are inherent in this rule. 
First, under the final rule with comment 
period, final adverse actions will lead to 
a high screening level assignment and 
the use of additional screening tools. 
Second, with regard to more stringent 
program safeguards, we believe there is 
much in this final rule with comment 
period to bolster our efforts at 
combating fraud, waste, and abuse For 
example, in this final rule with 
comment period, we are expanding the 
instances in which we can impose a 
payment suspension. Furthermore, for 
tlie first time in the history of the 
programs, we will be able to impose an 
enrollment moratorium in order to 


combat fraud, waste, and abuse. 
Accordingly, we believe the new 
authorities that we are implementing 
under the ACA will assist us in 
strengthening our program integrity 
efforts. 

Comment; A commenter 
recommended that the following be 
placed into the high screening level: (1) 
Any provider or supplier that is not 
State licensed, and (2) any owner, 
authorized official, delegated official, 
physician or non-physician practitioner 
who has ever been excluded by the OIG, 
revoked by Medicare, or had a State 
license revocation or suspension. 

Response; We stated previously that 
merely because a particular provider or 
supplier type may be regulated by the 
State is not in and of itself adequate 
grounds for placing it in a lower 
screening level. By the same token, we 
do not believe that a failure to be 
licensed by the State should 
automatically place the provider or 
supplier in a high screening level, as the 
State may not have licensure 
requirements for that particular provider 
or supplier type. In addition, the 
standards for licensure vary among the 
States and Territories such that these are 
largely out of our control. With regard 
to the commenter’s second suggestion, 
we again note that § 424.518(c) of the 
final rule with comment period states 
that a provider or supplier will be 
moved from the “limited" or “moderate” 
level to the “high” level if it has had 
final adverse actions imposed against it. 

Commenf.-A commenter 
recommended that CMS explain why it 
did not consider comments regarding 
publicly traded companies in the final 
rule with comment period; Home Health 
Prospective Payment System Rate 
Update for Calendar Year 2011; Changes 
in Certification Requirements for Home 
Health Agencies and Hospices, when 
developing the proposed policy found 
in the proposed rule to this final rule 
with comment period. 

Response; This rule and the rule that 
the commenter references deal with 
different issues. Each was developed 
and considered on its own merits. 

Comment: A commenter supported 
CMS's placement of hospitals and 
physicians into the limited screening 
level. However, the commenter 
disagreed that publicly traded DMEPOS 
suppliers orHHAs would have less risk. 
The commenter also stated that the 
providers and suppliers that are 
designated as “high risk” or “moderate 
risk” but which are members of, operate 
as a part of, or are owned by a hospital 
or a health system, should instead fall 
under the same risk assignment as the 
hospital. Such providers and suppliers 
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are part of larger established 
organizations that have high levels of 
accountability to their internal 
governance structures and have 
longstanding relationships with and 
responsibility to their local 
communities. 

Response: For reasons already stated, 
we have eliminated the distinction 
between publicly traded and private 
companies and have declined to 
subcategorize individual providers and 
suppliers based on their ownership. 

Comment; Several commenters 
requested greater specificity regarding 
what level of managing employees 
would be subject to the screening 
requirements for high risk providers and 
suppliers. Some of them requested that 
for large provider organizations, only 
the highest-level managing employees 
who operate or manage, or who oversee 
the operation of the entire healthcare 
organization — and not lower-level 
managers of individual departments or 
functions — should be subject to the 
enhanced screening procedures. 

Response: In this final rule with 
comment period, we will only apply the 
screening requirements for high 
screening level providers and suppliers 
to individuals with a 5 percent or 
greater direct or indirect ownership 
interest. Officers, directors, and 
managing employees — to the extent that 
they do not have a 5 percent or greater 
ownership interest — will not be subject 
to fingerprint-based criminal 
background checks. However, we intend 
to monitor the situation and may seek 
to extend the scope of fingerprint-based 
criminal background checks in the 
future if circumstances warrant. 

Comment; A commenter stated that 
hospitals should be exempted from all 
screening levels — even the limited 
screening level — if they are Slate- 
licensed and accredited. 

Response: We disagree with this 
commenter. To exempt a provider or 
supplier from any screening level would 
be the equivalent of stating that the 
provider need not undergo even the 
most basic verification requirements 
used under the limited risk level of 
screening. 

Comment: Several commenters 
supported site visits as a too! to improve 
program integrity, but believes that they 
could disrupt or administratively 
burden a legitimate provider or 
supplier’s business operations. They 
recommended that CMS limit the 
purpose of these site visits to verifying 
that the provider/supplier exists and is 
operational; other matters that would 
require significant management and 
clinical staff time should be handled 
through separately scheduled site visits. 


Several other commenters believe that 
site visits were appropriate, but said 
that the number of such visits must be 
reasonable for the circumstances and 
should only increase if inappropriate 
activity is suspected. In addition, 
another commenter suggested that as 
part of a DMEPOS site visit, the auditor 
should confirm with the owner of the 
warehouse or facility the terms of the 
lease; for HHAs, the auditor should 
confirm that the HHA has been using 
the OASIS form and that a sample of 
Patient Plan of Care medical records/ 
files can be directly linked to an OASIS 
document. 

Response: We decline to state that site 
visits will always be limited to verifying 
whether the provider or supplier is 
operational. We must retain the 
flexibility to conduct a closer on-site 
review if warranted. 

Comment. • One commenter stated that 
class! lying DMEPOS suppliers that are 
physician-owned as high risk could 
pose a significant disincentive to office- 
based physicians to continue offering 
DMEPOS supplies to their patients. The 
commenter stated that there has been 
little to no documentation of fraud, 
waste, or abuse in this category of 
DMEPOS. and that these suppliers 
should be exempted from the high risk 
level of screening. 

Response: For reasons already stated, 
we have declined to subcategorize 
individual providers and suppliers 
based on their ownership. 

Comment; Several commenters stated 
that the risk assessments of specific 
providers should not be made public. 

Response; To the extent allowed by 
Federal law, we will not release to the 
general public the risk assessment of an 
individual provider or supplier. Thus 
when an individual provider or supplier 
is elevated in screening level as a result 
of a triggering event in § 424.516 and 
§ 455.450. we will not publish the 
individual provider’s or supplier's 
name. 

Comment; Several commenters 
supported the creation of limited, 
moderate, and high screening levels, as 
well as the proposal to place physicians 
into the limited screening levels. They 
added that CMS should use public 
notice and comment prior to modifying 
the process or revising level 
assignments based on new criteria. 

Response: We appreciate the 
commenters support and will publish 
notice in the Federal Register regarding 
changes in assignment or levels of 
screening specified at § 424.518 and 
§ 455. 450. However, as mentioned 
previously, we will not publish 
information about an individual 
provider or supplier that meets certain 


triggering events as described in these 
sections. 

Comment; A commenter opposed 
“geographical circumstances” as a 
possible criterion for adjusting a 
provider or supplier’s screening level. 
This would deny all providers and 
suppliers in the specified geographic 
area basic due process and could 
seriously damage beneficiary access to 
health care providers and services in the 
impacted area. 

Response: We are not adopting 
“geographic circumstances” as a 
criterion for adjusting a provider or 
supplier’s screening level at this time. 
We believe that should circumstances 
arise where we have concerns about a 
provider or supplier type in a 
geographic area, the authority to impose 
an enrollment moratorium, as detailed 
in this rule, will provide program 
integrity protection. However, we do 
retain the authority to add geographic 
location as a criterion for adjusting a 
provider or supplier’s screening level 
through future rulemaking. 

Comment; Several commenters 
opposed the proposal to re-assign 
physicians from the “limited” or 
“moderate” screening level to the “high” 
screening level when CMS has evidence 
from or concerning a physician that 
another individual is using their 
identity within the Medicare program. 
Classifying physicians who have been 
the victims of identity theft to the high 
screening level would stigmatize the 
physician and create a presumption that 
he/she has engaged in conduct 
warranting heightened scrutiny. They 
urged CMS to establish a fourth level, 
which signifies a heightened level of 
risk to Federal health care programs as 
a result of compromised physician 
identity or identity theft, Another 
commenter requested that CMS clarify 
that it will be the offender who is 
subjected to additional scrutiny and that 
the victim will not be penalized for the 
actions of the offender. Another 
commenter, however, supported QMS’s 
proposal to adjust the categorical 
screening level if a practitioner notifies 
CMS or its contractor that another 
individual is using his or her identity 
within the Medicare program, and to 
require fingerprinting of high risk 
provider and supplier types (but not of 
individual practitioners who have been 
the victim of identity or provider 
number theft). 

Response; We stress that we will work 
closely with law enforcement against 
those individuals who are perpetrating 
Medicare identity theft. We do not plan 
to use screening tools to address 
identity theft concerns as it would not 
be an adequate response. We believe 
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identity theft concerns are most 
appropriately handled by our law 
enforcement partners. 

Comment; A commenter requested 
clarification as to the screening level 
assignment of in-home supportive 
services (IHSS). If they fail into the 
“moderate” level, as do home health 
agencies, the commenter expressed 
concern that site visits could burden 
program recipients. 

Response: Medicare does not 
recognize “in home supportive services” 
as a specific category of provider or 
supplier. To the extent that the IHSS 
supplier is or will be enrolling in 
Medicare or Medicaid as a HHA, it will 
be subject to the same requirements and 
standards as ail other HHAs. As for the 
site visits, they will generally be 
conducted at the HHA's physical 
locations. 

Comment; Several commenters 
expressed concern with the proposal to 
re-assign physicians (and other 
providers/suppliers) from the “limited” 
or “moderate" screening levels to the 
“high” screening level if a physician has 
had billing privileges revoked by a 
Medicare contractor within the previous 
ten years. Billing privileges can be 
revoked for a number of reasons 
unrelated to fraud, waste, or abuse, such 
as a failure to respond to a request for 
revalidation documentation within 
stringent contractor imposed deadlines. 
They urged CMS to differentiate 
between a temporary revocation of 
billing privileges and revocations based 
on actual misconduct by a provider or 
supplier. 

Response; As stated earlier, 
revocation is undertaken as an 
administrative remedy only if clearly 
justified. Also, there is an appeals 
process in place for provider 
revocations. Should a revocation be 
rescinded, the provider or supplier 
would be restored to its previous 
screening level. 

Comment: A commenter urged CMS 
to exercise the temporary moratorium 
authority judiciously and to exempt 
physicians from re-assignment from 
level I (limited) to level III (high) if 
physicians are ever subject to the 
temporary moratorium: this would 
include an exemption for physicians 
enrolled as DMEPOS suppliers if the 
latter are subject to a moratorium. 

Response; We believe this commenter 
is addressing a concern that if a 
moratorium is imposed on a category of 
providers that includes physicians or 
physician-owned DMEPOS suppliers, 
that when the moratorium is lifted the 
provider or supplier category to which 
the moratorium applied would be 
moved to the high screening level for 6 


months following the lifting of the 
moratorium. The commenter is asking 
for an exception to this proposal. A 
moratorium may be imposed if there is 
a heightened risk of fraud, waste or 
abuse in a particular geographic area or 
involving a certain provider or supplier 
type. If a particular provider or supplier 
type posed such a risk as to warrant a 
moratorium, it would be inappropriate 
for us to automatically exempt it from 
enhanced screening once the 
moratorium ends. In the event that we 
were to impose a temporary moratorium 
on physicians or physician-owned 
DMEPOS suppliers, the moratorium 
would be as narrowly tailored as 
possible to address specific fraudulent 
activity. 

Comment: A commenter believes that 
the moderate and high screening level 
assignments for community pharmacies 
are inappropriate and contended that: 

(1) all existing community pharmacy 
DME suppliers, as well as new locations 
of existing community pharmacy DME 
suppliers, should be designated as 
limited risk, and (2) newly enrolling 
community pharmacy DME suppliers 
should be treated as posing a moderate 
risk. The commenter stated that 
community pharmacies are already 
heavily regulated by the States and 
Federal government through State 
boards of pharmacy, CMS supplier 
standards and surety bonds, and argued 
that community pharmacies are not a 
major source of ftaud. The commenter 
also urged CMS to incorporate into its 
final rule the same exemption criteria 
that CMS’s uses to exempt certain 
community pharmacies from DME 
supplier accreditation requirements. In 
addition, the commenter stated that 
CMS should designate community 
pharmacies as limited risk suppliers if: 
(1) They have had a supplier number for 
at least 5 years; (2) their DME sales are 
less than S percent of their total sales 
over the last 3 years; and (3) they have 
not received a final adverse action 
against them in the past 5 years. 

Another commenter stated that 
DMEPOS sales are but a small portion 
of genuine community pharmacy sales. 
Accordingly, the proposal regarding 
unannounced pre- and/or post- 
enrollment site visits for moderate risk 
suppliers and criminal background 
checks and fingerprinting for high risk 
suppliers may prove unbearably costly 
and burdensome to community 
pharmacies. The commenter added that 
it could lead to community pharmacies 
to stop supplying DME products, 
causing access problems. 

Response; As already staled, all 
newly-enrolling DMEPOS suppliers, 
regardless of sub-type or ownership, 


will be placed in the high level of 
categorical screening. This includes new 
DMEPOS locations, which have long 
been treated as initial enrollments. 
Moreover, we do not believe it is 
appropriate to apply the community 
pharmacy exemption for accreditation 
to the risk classifications, as the 
standards for accreditation are different 
from the criteria we are using for the 
risk classifications. 

Comment; A commenter urged CMS 
to more narrowly tailor its risk 
assignments of provider or supplier 
types by geography, so that DMEPOS 
suppliers in many areas of the country 
are not unfairly grouped into a higher 
screening level merely because those 
same DME supplier types pose major 
fraud risks in other limited areas of the 
country. 

Response-.We disagree. While some 
areas of the country are undeniably 
more prone to fraud than others, 
fraudulent activity can occur anywhere. 
Furthermore, we believe it most 
objective to apply the same standard to 
all parts of the country and use other 
tools to narrowly tailor our approach 
when necessary, including the 
enrollment moratoria provision set forth 
in this final rule with comment period. 

Comment: A commenter requested 
clarification on whether an existing 
commnnity pharmacy DME supplier 
that seeks to add a new DMEPOS 
supplier store would fail under the 
moderate or high screening level under 
the proposed rule. The commenter 
believes this should fall within the 
moderate screening level. 

Response: As already stated, the 
addition of a new DMEPOS location 
would be subject to the level or 
screening specified for providers and 
suppliers assigned to the high screening 
level. 

Comment: A commenter expressed 
concern that the Medicare contractor 
may not know which companies are 
publicly traded. 

Response: We have eliminated the 
distinction between publicly traded and 
non-publicly traded companies; as such, 
this comment is no longer applicable. 

Comment: One commenter slated that 
on June 23 , 2010, the Director of the 
Office of Management and Budget 
published a memorandum titled, 
“Enhancing Payment Accuracy” through 
a “Do Not Pay List”: this Presidential 
document stated that, “At a minimum, 
agencies shall, before payment and 
award, check the following existing 
databases (where applicable and 
permitted by law) to verify eligibility: 
the Social Security Administration 
Death Master File, the GSA’s EPLS, the 
Department of the Treasury’s Debt 
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Check Database, the Department of 
Housing and Urban Development’s 
(DHUD) Credit Alert System or Credit 
Alert Interactive Voice Response System 
and the DHHS OIG LEIE.” The 
commenter stated that CMS should 
explain why the proposed rule does not 
mention these verification sources. 

Response; Medicare contractors have 
long been required to review the EPLS 
and the LEIE prior to enrolling a 
provider or supplier in Medicare. In 
addition, providers, suppliers and their 
owners and managers are currently 
reviewed against the SSA Death Master 
File, As for the DHUD Credit Alert 
System and the Department of the 
Treasury’s Debt Check Database, we 
understand the Presidential 
memorandum requires review of these 
systems prior to payment or award and 
will integrate their use as appropriate in 
our protocols. 

Comment: Several commenters 
supported the placement of hospitals in 
the limited screening level, However, 
they added that high risk or moderate 
risk providers and suppliers that are 
members of, operate as a part of, or are 
owned by a hospital or a health system, 
should instead fall under the same 
limited risk assignment that CMS 
proposes for hospitals. 

Response: Again, for reasons already 
mentioned, we have declined to 
subcategorize individual providers and 
suppliers based on their ownership. 

Lommenh* Several commenters stated 
that in States with orthotic and 
prosthetic licensure, orthotic and 
prosthetic DMEFOS suppliers should be 
designated as limited risk, as there is no 
evidence of significant elevated risk for 
such licensed professionals. In States 
without orthotic and prosthetic 
licensure, several commenters stated 
that the supplier should be treated as 
limited risk if: (1) One or more of the 
supplier's practitioners are certified by 
the American Board for Certification of 
Orthotics, Prosthetics and Pedorthics or 
the Board of Certification/Accreditation 
International, or (2) the supplier itself 
has been accredited by one of these 
entities. Other commenters stated that if 
the orthotic and prosthetic supplier is 
not practitioner owned, but has been in 
business at least 3 years, it should be 
considered limited risk due to a 
demonstrated lack of inappropriate 
billings over time; if it is not 
practitioner-owned and has not been in 
business at least 3 years, it should be 
rated as a moderate risk. Finally, the 
commenters objected to the proposed 
risk provision for this risk assignment 
provision because; (1) Orthotics and 
prosthetics is not part of DME, and has 
significantly lower fraud and abuse 


risks; and (2) there has not been 
sufficient consideration of the impact of 
number of years in business, or 
accreditatlon/certincation status as 
factors that diminish risk. 

Response: As stated earlier, we do not 
believe certification or accreditation to 
be dispositive of risk for fraud and 
decline to adopt this suggestion. While 
we appreciate the commenter’s 
suggestion that we should look at length 
of time in business as a means of 
supporting the assessment of risk, we 
believe that OIG and GAO reports and 
experiences are instructive and rely on 
those as well as our own data to support 
the assignment to levels of screening 
that we Hnalize in this rule. 

Comment: A commenter expressed 
concern that the time and cost necessary 
to comply with the requirements in the 
proposed rule is a significant burden on 
small providers, in light of all of the 
other requirements they are subjected 
to. The commenter stated that for 
reasons of reduced risk, time in business 
and demonstrated commitment to 
quality, no certified practitioner or 
accredited orthotist or prosthetist 
facility should be subject to background 
checks and fingerprinting. 

Response; We decline to adopt this 
suggestion; to do so would foreclose the 
possibility that any high risk 
practitioner or orthotic or prosthetic 
facility would be subject to enhanced 
scrutiny. 

Comment: A commenter questioned 
whether requirements such as 
fingerprinting will accomplish CMS’s 
goal of tracking violators, since CMS 
will have no way to ensure that the 
person providing the fingerprints is the 
person rendering the care. The 
commenter also questioned whether 
fingerprinting will help prevent identity 
tbeh for physicians. 

Response: We are confident that 
fingerprint-based criminal history 
record checks will enable us to identify 
individuals who violate CMS existing 
regulations at § 424.530(a} and 
§ 424.535(a}, and appropriately deny or 
revoke Medicare billing privileges in 
these circumstances. This screening tool 
is intended to prevent individuals who 
pose an elevated risk of fraud, waste, 
and abuse from enrolling in the 
programs. Physicians will not be subject 
to the fingerprint-based criminal history 
check if they are not in the high 
screening level. Physicians as a category 
are in the limited screening level and 
providers and suppliers in the limited 
screening level are not subject to 
fingerprint-based requirements as are 
individuals and entities in the high 
screening level. The submission of 
fingerprints for the purposes of an FBI 


criminal history record check is not 
intended to address identity theft 
concerns. 

Commenf; A commenter stated that 
raising a supplier’s screening level 
seems reasonable only if the supplier 
has come under a payment suspension 
or if after investigation, the type of 
provider and the services it will render 
are not congruent on its enrollment 
application. 

flesponse; We disagree. There are. as 
explained in this final rule with 
comment period, a variety of final 
adverse actions that we believe warrant 
the placement of a provider or supplier 
in a higher screening level Payment 
suspensions and inconsistent 
information on the enrollment 
application should not be the only two 
grounds for elevating a provider’s 
screening level. 

Comment; A commenter stated that 
with regard to the “high” screening 
level, although government enforcement 
efforts to date have shown fraud, waste 
and abuse issues with HHAs and 
DMEIPOS suppliers in certain 
geographical regions (for example. 

South Florida, Texas, and California), it 
is not clear that issues with such entities 
are national. Because the criminal 
background checks and fingerprints are 
onerous requirements that are not 
currently used by Medicare, the 
commenter stated that CMS should limit 
itself to introducing such requirements 
in high risk geographic areas, rather 
than nationally, at least at this stage. 
Moreover, the commenter stated that 
CMS has neither provided the data nor 
made the convincing case that its 
proposed changes will deliver results to 
justify the extent to which the rules 
would intrude on normal patient care 
and business practices. With respect to 
orthotic and prosthetic suppliers, the 
commenter urged CMS to adopt a more 
realistic approach that cracks down on 
fraudulent providers, without either 
considering every provider to be a 
crook, or adding huge regulatory 
burdens that could put honest, 
legitimate, hard-working orthotic and 
prosthetic suppliers out of business. 

Response: We disagree that our 
enhanced screening procedures should 
initially be restricted to high risk 
geographical areas. While some regions 
of the country evidence fraud, waste 
and abuse more than others, fraudulent 
activity can occur anywhere. In 
addition, we believe that a national 
approach is most objective in 
implementing the screening provisions 
herein. We will rely on other program 
integrity tools, including, without 
limitation, the enrollment moratoria 
authority contained within this rule, to 
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address concerns in particular locales. 
Moreover, CMS will monitor 
implementation of the final 
requirements on provider and supplier 
screening with respect to patient care 
and business practices. 

Comment: A commenter stated that 
with respect to changing a health care 
provider's level of screening, the basis 
for this determination should be on 
information released during 2011 and 
beyond. 

Response; We disagree. We have 
found that long-term trends (for 
example, data from 2005 through 2009) 
are often good indicators of potential 
fraudulent activity. 

Commenf; A commenter suggested 
that CMS establish certain exemptions 
to DMEPOS suppliers prior to a 
company being deemed a moderate or 
high risk supplier, such as: {!) A 
multiple year history as a DMEPOS 
provider; (2) award of a DMEPOS 
competitive bidding contract (where 
CMS itself has extensively reviewed the 
financials of contracted suppliers): and 
(3) accreditation by a CMS-approved 
third party. 

Response; We did not base our 
development of levels of screening and 
the assignment of provider and supplier 
categories to these levels of screening of 
fraud, waste or abuse on the past 
experience of specific individual 
providers. Rather, it is based on 
collective experience of provider and 
supplier categories. Furtnermore, we do 
not believe length of time in business is 
an appropriate determination of fraud 
risk. Similarly, as described previously, 
we do not believe accreditation is~>in 
and of itself — an indication that a 
provider or supplier should be assigned 
to the limited screening level. Finally, 
we decline to accept the commenter's 
suggestion that the award of a DMEPOS 
competitive bidding contract should 
provide an exemption from the 
assignment specified in this rule. The 
criteria for competitive bidding are 
different than those that we are using to 
determine the appropriate screening 
level appropriate to particular categories 
of provider or supplier. 

Comment; A commenter stated that 
any criteria utilized by CMS to assign 
screening levels should be made public, 
and that CMS should regularly review 
its assignment to screening levels. The 
commenter questioned whether 
automatically applying the proposed 
additional screening measures for 
providers and suppliers assigned to the 
moderate and high levels will be 
effective in shutting-out sham suppliers 
and past violators from participating in 
Medicare, particularly since these 
safeguards do not protect Medicare 


against criminals who use a shell as the 
owner of record to avoid detection. The 
commenter believes that the recently 
implemented accreditation and bonding 
requirements for DMEPOS suppliers are 
a stronger deterrent in ensuring that 
fraudulent suppliers are not able to 
participate in Medicare, and 
recommended that CMS first determine 
whether these requirements adequately 
deter fraud before imposing additional 
and arguably less elective safeguards, 
especially considering the cost and 
burden of these new requirements. 

Response; Criteria for the risk 
assessments were discussed in the 
proposed rule and this final rule with 
comment period. The criteria will be 
reviewed on a consistent and ongoing 
basis, and in the event we decide to 
update the assignment of screening 
levels, we will publish a regulatory 
document in the Federal Register. We 
do not believe, though, that we should 
wait for the results of the accreditation 
and surety bond requirements before 
taking additional steps to address 
program integrity problems related to 
DMEPOS suppliers. Indeed, it could 
take several years for the full impact of 
the surety bond and accreditation 
requirements to take effect on our anti- 
fraud efforts. As such, we do not believe 
it to be premature to assign newly- 
enrolling DMEPOS suppliers to the high 
screening level and require enhanced 
screening pursuant to this rule. It is our 
expectation that all of these program 
integrity protections together will lessen 
the risk of fraud and abuse in the 
Medicare program. 

Comment: A commenter stated that 
the language in §424.500. et seq., does 
not define “Medicare contractor.” and 
the verbiage in the preamble is 
somewhat vague. Tne commenter 
requested clarification as to: (1) The 
contractors that will be conducting the 
on-site visits, (2) whether this approach 
will be uniform across the country, and 
(3) the training and experience-the 
individuals conducting these visits will 
have. 

Response: Since the term “Medicare 
contractors,” as used strictly in the 
provider enrollment context, is 
generally understood and recognized by 
the.provider community to mean the 
entities that process CMS-855 provider 
enrollment applications, we do not 
believe it is necessary to include a 
formal definition of this term in this 
final rule with comment period. The 
contractors that will conduct site visits 
will vary, as will the scope and breadth 
of individual visits; however, such site 
visits will be in accordance widi 
guidance issued by CMS, Those who 
will conduct site visits will receive 


appropriate instructions and oversight 
regarding the performance of the visits. 

Comment: Several commenters stated 
that HHAs and hospices are already 
subject to a State survey prior to 
enrollment — as well as on a periodic 
basis thereafter — thus making a site visit 
superfluous. As such, initially enrolling 
HHAs and hospices should be included 
in the limited .screening level rather 
than in the moderate screening level. A 
commenter also stated that including all 
revalidating HHAs, hospices and DME 
suppliers in the moderate screening 
level is unfair and inappropriate, as they 
are already established providers; the 
commenter believes it should be exempt 
from the site visit requirement if it has 
been in existence for at least 5 years and 
there is no reason to suspect fraudulent 
activity. The commenter added, 
however, that additional site visits and 
increased medical review during the 
provider’s first 5 years of enrollment 
could be performed to ensure 
compliance. Another commenter stated 
that it would be better to conduct HHA 
site visits, if they had to be performed, 
with existing or recent patients in their 
homes, since most care is provided to 
patients in their homes; care is not 
provided in the HHA or hospice office. 

Response: We do not believe that a 
site visit is superfluous. Due to the 
length of the enrollment, survey, and 
certification processes, we believe it is 
important for us to institute verification 
activities at multiple points during this 
period, and not to restrict its validation 
efforts to the enrollment process and the 
State survey, Moreover, we do not 
believe that site visits should be limited 
to providers who have been enrolled for 
less than S years, as we do not have data 
to suggest t^iat those who have been 
enrolled for S years or more present less 
of a fraud, waste, and abuse concern 
than newly enrolled providers and 
suppliers. Finally, and as mentioned 
earlier, provider enrollment site visits 
will be conducted at the HHA's physical 
locations. 

Comment: A commenter asked CMS 
to describe the process the Medicare 
contractors are using to review State 
licensing data on a monthly basis. The 
commenter also requested clarification 
as to whether the reference to “non- 
public, non-govemment owned” applies 
only to affiliated ambulance services 
suppliers, or extends to the other 
provider types listed in die moderate 
level. 

Response; The contractors use various 
processes to review licensure data: 
frequently, this is an automated process. 
With regard to the clarification 
requested, the term as used in the 
NPRM applied only to ambulance 
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suppliers. However, as we have 
eliminated the distinction between 
public and non-public ambulance 
service providers, this comment is no 
loiter applicable. 

Comment: A commenter suggested 
that CMS consider reclassifying 
providers and suppliers in the 
“moderate” and “high” screening level to 
the “limited” risk level if the provider or 
supplier is subject to State licensure 
requirements. In addition, the 
commenter opposed reclassifying 
providers or suppliers from one 
screening level to another based strictly 
on their geographical location. To do so 
would be arbitrary, and would not 
reflect the risk associated with 
particular provider or supplier types. 

Response: As already mentioned, we 
do not believe that State licensure is, in 
and of itself, indicative of a limited risk 
of fraud. In addition, we do not plan to 
reclassify providers or suppliers based 
solely on geographical location. As 
stated earlier, if we identify a concern 
among provider and supplier categories 
in a particular geographic location, our 
authority to impose a temporary 
moratorium will help to address those 
concerns, However, we do retain the 
authority to add geographic location as 
a criterion for adjusting a provider or 
supplier’s screening level through future 
rulemaking. 

Comment: A commenter expressed 
concern that fingerprinting: (1) Could be 
very costly; (2) raises privacy and 
security concerns once an organization 
begins to collect, maiiitain, administer 
access and store a database of 
fingerprints; and (3) is technologically 
being replaced by much more modern 
and reliable identification techniques. 
The commenter urged CMS to avoid 
requirements for fingerprinting in 
screening requirements and to use more 
modern techniques. 

Response; As already mentioned, we 
believe that fingerprint-based criminal 
history record checks will be an 
effective tool in combating Medicare 
waste, fraud, and abuse, In our view, 
such criminal history record checks — 
more effectively than a name-based 
background check — will prevent 
ineligible individuals from enrolling in 
the Medicare program. CMS believes 
that the cost to both the applicants for 
the collection of fingerprints, and to 
CMS for the processing of the prints is 
not unduly burdensome either to the 
providers and suppliers or the agency. 
We would like to clarify that CMS will 
not be collecting and storing any 
fingerprints. As mentioned earlier, the 
selected authorized channeler will 
collect and transmit the prints 
electronically directly to the FBI CJIS 
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Division’s Wide Area Network to check 
against the lAFIS, the FBI maintained 
database. CMS will only receive the 
criminal history record information, and 
will protect that information as the 
Privacy Act requires — ^both from a 
privacy and security standpoint. In 
response to the commenter's third 
remark, while CMS is aware of the 
advances in technology in the biometric 
market, the FBI and State law 
enforcement standard is currently the 
fingerprint. Once the FBI or State law 
enforcement requires a new standard of 
identification to access the criminal 
history record information, we will 
comply with that standard. 

Comment: A commenter suggested 
that in implementing the screening 
requirements, CMS should minimize 
duplication of effort. Often the same 
providers who participate in traditional 
Medicare ore also participating in other 
plans, such as Medicaid. Having 
separate screenings could be 
burdensome and inefncient. 

Response: We agree with the 
commenter that every possible attempt 
should be made to avoid duplication of 
effort. To that end, we have attempted 
to address this concern by providing 
that the States may rely upon a 
screexting performed by the Medicare 
pr^ram. 

Comment: A commenter supported 
the concept of applying geographical 
circumstances when adjusting providers 
or suppliers from one screening level to 
another, and recommended that anti- 
fraud efforts be coordinated with other 
payers — such as through information 
sharing — because providers and 
suppliers perpetrating fraud do so 
across the spectrum of payers, and that 
reality should be integrated into CMS’s 
overall strategy. 

Response: We agree that anti-fraud 
efforts should be coordinated among 
payors and we are taking steps to 
promote greater coordination. As stated 
previously, we believe our temporary 
moratoria authority described later in 
this rule will be an effective tool in 
particular geographic locations. We may 
revisit as a factor for enrollment 
screening level in future rulemaking. 

Comment: Several commenters stated 
that new locations of currently enrolled 
Medicare DMEPOS providers should be 
distinguished from other providers that 
do not have an established record with 
the Medicare program. CMS should 
therefore screen new locations of 
Medicare enrolled suppliers in the same 
manner as it proposes to screen 
currently enrolled providers. 

Response: We disagree. As previously 
stated, the addition of a new location is 
considered an initial enrollmonl. 


Consequently, a new DMEPOS location 
will be subject to the “high” level of 
categorical screening. 

Comment: Several commenters 
requested that occupational and 
physical therapists, including those 
enrolled or applying to enroll as 
DMEPOS suppliers, be placed in the 
limited risk level. 

Response: As stated earlier, all newly- 
enrolling DMEPOS suppliers (including 
those with new practice locations), 
regardless of sub-type, and including 
those that are owned by occupational 
and/or physical therapists, will be 
subject to a high level of categorical 
screening, For physical therapists 
enrolling as individuals or group 
practices via, respectively, the CMS- 
8551 and CMS-855B applications, these 
suppliers will be placed in the moderate 
level of screening. As we explained 
earlier with respect to physical therapy 
providers, we believe the classification 
of physical therapists in the moderate 
level is supported by a recent OIG report 
entitled “Questionable Billing for 
Medicare Outpatient Therapy Services” 
(December 2010) {bttp://oig.hhs.gov/oei/ 
reports/oei-04-09-00540.pdf], which 
found, among other things, that Miami- 
Dade County had three times, and 
nineteen other counties had at least 
twice, the national level on five of six 
questionable billing characteristics. 

Comment: A commenter asked 
whether CMS will identify the 
contractors that will perform these 
screenings, or whether it will accept 
screenings performed by commercial 
screening services widely used. by large 
employers outside the health care 
industry. 

Response: We believe the commenter 
is referring to criminal background 
screenings. To comply with the FBI 
requiremeiits that only authorized 
channelers submit fingerprints to the 
Wide Area Network, and receive the 
criminal history record information 
from the FBI. CMS will contract with a 
pre-approved FBI authorized channeler. 
In the future guidance, CMS will 
identify the selected authorized 
channeler(s) where individuals may 
have their fingerprints collected, or to 
whom they may submit the FD-258 card 
that was completed at a local law 
enforcement agency. In addition to 
ensuring compliance with FBI security 
requirements, such authorized 
channeiers have vendors all over the 
country where individuals can have 
their fingerprints electronically 
collected. In addition, individuals may 
have their prints taken on the FD-258 
paper card at a local law enforcement 
agency, and then have it sent to the 
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authorized channeler to have it digitized 
and submitted to the FBI. 

Comment; A commenter had several 
suggestions for screening levels. The 
commenter recommended that the 
limited screening level include 
providers affiliated with non-profit 
acute care hospitals or health systems: 
any not-for-profit providers who have 
been in existence for at least 20 years 
and who have filed annual cost reports 
(if required) for their line of business; 
and any for-profit providers in business 
for 20 years as a single site provider. 

The moderate screening level should 
include all other providers except those 
indicated in the high screening level, 
plus any provider who has entered into 
a settlement with a government agency 
{Federal, State or local) within the past 
20 years, up through the most recent 5 
years, where such settlement covered 
any over-charge allegations. The high 
screening level should include any 
provider who has entered into a 
settlement with a government agency • 
(Federal, State or local) for any 
overpayment in the past 5 years; and 
any provider or group of providers 
which may currently be under review 
for possible billing overcharges or other 
violations who is seeking either a new 
provider number or seeking a new 
provider location. 

Ftesponse; We appreciate these 
suggestions, and may consider them as 
part of a future rulemaking effort should 
circumstances warrant, However, for 
now, and for the reasons described 
previously, we believe that the 
screening level assignments discussed 
in this preamble will best implement 
the statute. 

Comment: A commenter 
recommended that CMS rehain from 
publicly posting risk levels, particularly 
as they relate to Individual providers or 
group practices. The commenter 
believes that in some instances this 
could give a false impression as to the 
level of risk of any provider or supplier, 
and that CMS has not clarified how this 
action will assist the agency with fraud 
prevention. 

Response: To the extent permitted by 
Federal law, we do not plan to publish 
risk assessments and the corresponding 
screening level of individual providers 
or suppliers. 

Comment: A commenter urged CMS 
to provide contractors with sufficient 
and targeted resources to handle 
identity theft screening to ensure that 
the additional screening precipitated by 
identity theft will not delay processing 
of new enrollment applications. 

Response: As mentioned throughout 
this rule, we do not plan to use 
fingerprint-based criminal history 


record checks to address identity theft 
concerns. Identity theft is within the 
purview of law enforcement and we will 
make referrals to our law enforcement 
partners whenever appropriate. 

Comment; A commenter requested 
clarification as to whether a revalidating 
provider would need to resubmit 
fingerprints with its application. The 
commenter believes this would be 
burdensome, costly, and unnecessary, 
since fingerprints do not change. 

Response: If an individual has 
provided fingerprints on one occasion, 
we will not ask such individual to 
furnish fingerprints a second time 
unless required by FBI protocols. 

Comment; A commenter disagreed 
that in all cases publicly traded entities 
pose a “limited” risk while all HHA 
companies that are not publicly traded 
pose a “moderate” risk to the program. 
The commenter supported the “high” 
risk assignment for those new to the 
program, but stated that the proposed 
rule does not consider that companies 
that have operated successful and 
compliant HHAs for years would fail 
into the high screening level if they 
were to open a new location or branch 
simply based on the arbitrary 
assignment of the screening level. 

Response: As stated earlier, we 
believe that newly enrolling HHA 
locations (for which a CMS-855 is 
submitted) should be subject to the 
enhanced scrutiny of the high risk 
screening level. Further, as stated 
earlier, we have eliminated the 
distinction between publicly traded and 
non-publicly traded companies. 

Comment: A commenter urged CMS 
to expand the definition of limited risk 
to include entities that file with the 
Securities and Exchange Commission 
(SEC), even though they do not have 
securities traded on the NYSE or 
NASDAQ. By reason of their debt 
obligations, such entities are subject to 
the same disclosure and reporting 
requirements under Federal securities 
laws as a company that is subject to 
section 13 or 15(d) of the Securities 
Exchange Act of 1934, as amended (the 
“Exchange Act”). 

Response; As stated earlier, we have 
eliminated the distinction between 
publicly traded and non-publicly traded 
companies, and the comment is no 
longer applicable. 

Cornmenf; A commenter stated that 
adjusting HHAs from the “limited” or 
“moderate” screening level to “high” risk 
simply because they reside in an area 
for which CMS imposes a moratorium is 
arbitrary and punishes good HHAs with 
no consideration of their compliant 
service to the Medicare beneficiaries 
and the program. 


Response: As explained elsewhere in 
this section and also later in the general 
discussion regarding moratoria, a 
moratorium may be imposed if there is 
a heightened risk of fraud, waste, or 
abuse in a particular area or involving 
a certain provider or supplier category. 

If a particular provider or supplier type 
posed such a risk as to warrant a 
moratorium, it would be inappropriate 
for us to automatically exempt it from 
enhanced screening once the 
moratorium ends. To do so would, in 
effect, require us to state that once the 
moratorium ends, that provider or 
supplier type no longer poses a risk, a 
conclusion that we could not 
necessarily draw. 

Commerrf; A commenter stated that 
the assignment of risk should be based 
on defined criteria beyond those 
proposed, such as compliance history 
related to billings, medial review, and 
history of negative audits from the 
program safeguard contractors. The 
commenter added that defined criteria 
should also be used to identify when 
providers are moved to different 
screening levels. For instance, brand 
new HHAs with no previous enrollment 
history should be part of the high 
screening level; however, upon 5 years 
of compliant operation, they should be 
moved to the moderate screening level, 
If a company with a 5 year compliance 
history opens a HHA, it should, not be 
assigned to the high screening level; 
instead, it should be assigned to the 
moderate screening level based on its 
good history with Medicare. Agencies 
that have a 7 year or more compliance 
history should be assigned the limited 
screening level. 

Response: Though we do not at this 
point believe that length of time as a 
Medicare provider should be a criterion 
for reducing a provider’s or supplier’s 
screening level, we may consider this as 
part of a future rulemaking effort should 
circumstances warrant. 

Comment; A commenter believes that 
the phrase “Indian Health Service . 
facilities” should be deleted in favor of 
“health programs operated by an Indian 
Health Program (as that term is defined 
in section 4{i2) of the Indian Health 
Care Improvement Act) or an urban 
Indian organization (as that term is 
defined in section 4(29) of the Indian 
Health Care Improvement Act) that 
receives funding from the Indian Health 
Service pursuant to Title V of the Indian 
Health Care Improvement Act.” Such 
language would encompass all Indian 
and tribal programs that are carried out 
pursuant to the Indian Health Care 
Improverhent Act (IHCIA) and Indian 
Self-Determination and Education 
Assistance Act (ISDEAA). Moreover, to 
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ensure that ail Indian and tribal health 
programs are treated as limited risk, the 
exception in (bKl) and (c){l) should be 
amended to refer to Indian and tribal 
health programs. The commenter stated 
that the burden on Indian and tribal 
providers of meeting new screening 
requirements would be significant and 
duplicative of screening requirements 
imposed already under the Indian Child 
Protection and Family Violence Act on 
many of the providers, 

Response; We will revise the language 
in the final regulation as requested by 
the commenter to ensure that Indian 
and tribal health programs are described 
accurately and are assigned to the 
limited screening level. 

Comment; A commenter stated that 
CMS should designate provider 
screening levels in the final rule with 
comment period, and should require 
changes in the risk level for a provider 
type to be subject to the rulemaking 
process. 

Response: We have specified the 
different screening levels in this final 
rule with comment period. Should a 
change in a particular provider or 
supplier type's classification be 
warranted and should it necessitate a 
change in existing regulatory language, 
we will publish notice of it in the 
Federal Register. However, we will not 
publish notice of the circumstances 
under which an individual provider or 
supplier has been moved to an elevated 
level of screening as described in 
§ 424.5ie(c) and § 455.450(e). 

Comment: A commenter stated that 
ophthalmologists, optometrists, and 
opticians who only bill as DMEPOS 
suppliers for post-cataract glasses and 
lenses should fall into the limited 
screening level. 

Response; As detailed previously, 
currently enrolled DMEPOS suppliers 
will be pieced in the moderate level of 
categorical screening and newly- 
enrolling DMEPOS suppliers will be 
assigned to the high level of screening. 

Comment: A commenter opposed 
CMS’ proposal to consider assigning all 
providers or suppliers in a specific 
geographic location to a higher level of 
screening, solely because others in that 
area may be considered moderate or 
high risk. The commenter believes this 
type of action was arbitrary, and could 
cause new, limited risk providers to 
think twice before entering a geographic 
market, thus potentially blocking 
beneficiary access to needed services. 

Response; We did not assign any 
provider or supplier category to a 
screening level based on geography. 

Comment; A commenter did not 
believe independent laboratories should 
be placed in the moderate screening 


level, due to their high level of 
regulation. The commenter stated that 
the sheer volume has no bearing on risk 
and that they are already subject to 
regular site visits. 

Response; We disagree. Based on our 
experience, we believe that independent 
laboratories are appropriately assigned 
to the moderate screening level. We note 
that newly-enrolling DMEPOS suppliers 
are. too, subject to site visits, yet they 
are assigned the high screening level. 

Comment: A commenter stated that 
all physicians should not be placed in 
the limited screening level. Several 
specialties are increasingly engaging in 
abusive self-referral arrangements. 

Response; For the reasons stated 
previously, we believe that physicians 
and non-physician practitioners are 
appropriately classified in the limited 
screening level. Moreover, we note that 
the final rule with comment period 
contains provisions for elevating a 
particular physician’s or practitioner's 
screening level in certain circumstances. 

Comment; One commenter disagreed 
that geographical circumstances should 
justify the adjustment of FQHC 
providers and suppliers to elevated 
screening levels based upon this 
criterion alone. The commenter stated 
that FQHC entities are in an entirely 
different classification and should not 
be subject to the same categorical 
movement. 

Response; We assume this commenter 
is concerned about our ability to 
reassign providers or suppliers after a 
temporary moratorium is lifted such 
that FQHCs could be classified as high 
risk in the event they are located in an 
area in which a temporary moratorium 
is lifted. We intend to finalize the 
elevated risk factors. We believe it 
important to closely monitor all 
providers and suppliers in the event a 
temporary moratorium is imposed— and 
for a period thereafter. We note that this 
would only apply to providers and 
suppliers to which the moratorium 
applied. Unless the moratorium that 
was lifted had applied to either all 
providers and suppliers in a geographic 
area or to a category of providers or 
suppliers that included FQHCs or to 
FQHC specifically, the elevation to the 
high screening level would not apply to 
FQHCs or any other provider or supplier 
category not originally subject to the 
moratorium. 

Commenf; A commenter: (l) 

Expressed concern about potential 
application delays if the Medicare 
contractors have insufficient funds to 
conduct these visits; (2) requested 
assurances from CMS that adequate 
funds will exist; and (3) recommended 
that CMS provide guidance to the 


Medicare contractors on the timeframes 
within which enrollment inspections 
shall occur. 

Response: We believe that adequate 
funds will exist to perform the required 
site visits, and we will issue guidance 
to our contractors regarding processing 
times. 

Commenf; A commenter expressed 
concern that tax-exempt, faith-based 
HHAs will be subject to a higher level 
of scrutiny than publicly traded for- 
profit HHAs. The commenter believes 
that such faith-based HHAs should be 
placed in the limited screening category. 

Response; We have eliminated the 
distinction between publicly traded and 
non-publicly traded HHAs. We decline 
to adopt the commenter’s suggestion to 
assign faith-based HHAs in the limited 
level of screening as it has not been our 
experience that faith-based HHAs 
present a different risk of fraud and 
abuse than non-faith-based HHAs. 

Comment; A commenter stated that 
the inclusion of CMHCs in the 
“moderate” risk group seems 
appropriate given the history of fraud in 
“for profit” CMHCs. The commenter 
believes, however, that in the future, 
“not for profit” CMHCs be considered 
for status as a “limited” screening level. 

Response: We decline to adopt the 
commenter's suggestion, as it has not 
been our experience that non-profit 
CMHCs pose a different risk than for- 
profit CMHCs, We will monitor CMHCs 
and other provider and supplier types 
after this final rule with comment 
period is implemented and, if need be, 
make adjustments to various risk 
classifications. 

Comment: A commenter stated that 
the fingerprint requirement is 
problematic, The FD-258 fingerprint 
card could be fairly easy to obtain and 
complete without the involvement of 
government officials or by manipulating 
the form before forwarding it to the 
concerned government representative 
which could lead to fraudulent data 
being accepted by CMS contactors. In 
order to ensure the validity and 
acceptability of fingerprint data, the 
commenter stated that a clear chain of 
custody will be required for the FD-258 
cards, providing for uninterrupted and 
secure forwarding of the completed 
cards from an originating law 
enforcement office to the CMS 
contractor. The commenter believes that 
consultation with the FBI and other 
expert agencies on this subject could 
prove valuable. 

Response: CMS has consulted and 
will continue to consult with the FBI 
regarding the use of the FD-258 card, As 
noted previously, CMS has found that in 
addition to a longer processing lime for 
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the FD— 258, there is a higher cost to 
CMS for the processing of such cards. 
However, individuals who have their 
prints collected by a local law 
enforcement agency must use the FD- 
258 card and submit it to CMS’ 
authorized channeler. The authorized 
channeler will digitize such FD— 258 
cards obtained at a local law 
enforcement agency for submission to 
the FBI. The chain of custody will 
conform to the FBI Security and 
Management Control Outsourcing 
Standard for Channelers and Non- 
Channelers and the FBI’s Criminal 
Justice Information Services (CJIS) 
Division’s Security Policy. 

Comment: A commenter 
recommended that the proposed 
screening procedures be applied across 
the board for all providers and suppliers 
in or being introduced into any aspect 
of the Medicare, Medicaid or CHIP 
system. 

Response: We disagree with this 
comment. Different categories of 
providers and suppliers pose different 
risks that must be addressed in distinct 
ways. 

Comment: A commenter 
recommended that when determining 
whether to adjust an individual 
DMEPOS supplier’s screening level, 
CMS should consider the supplier’s; 

(1) Experience in furnishing services; (2) 
experience in the geographic area; (3} 
accreditation status and compliance 
with quality standards; and (4) 
compliance program, as well as any past 
fraudulent activity by the supplier or its 
employees and the category of DMEPOS 
it furnishes. 

Response: We decline to adopt this 
approach. First, we believe that this 
could ba subject to inherently arbitrary 
implementation. Second, as has been 
described previously, we believe the 
ACA requires us to assign categories of 
providers and suppliers to a level of 
screening based on the risk for fraud. 
The criteria the commenter proposes 
would necessitate a level of pre- 
screening that is not feasible for every 
applicant CMS must process. 

Comment: A commenter stated that 
providers and suppliers should be 
individually notified of the screening 
level into which they will be placed and 
the reasons for such designation. The 
categorizations should not be made 
public because that could easily lead to 
irreparable damage to reputations and 
the companies’ business. 

Response: The publication of this 
final rule with comment period serves 
as notification to suppliers and 
providers of the assignment of their 
category to a particular screening level. 
The only new screening requirement 


that requires action on the part of a 
provider or supplier is the fingerprint- 
based criminal history record check. As 
stated, there will be an additional 60 
day period after the publication of 
subregulatory guidance prior to its 
implementation for DM^OS and 
HHAs. In instances where an individual 
provider or supplier has been reassigned 
to a higher level of scrutiny under 
§ 424.516(c)(3}, we anticipate that each 
provider or supplier will be 
individually notified of its newly 
assigned screening level prior to 
revalidation. This process will be 
clarified in the subregulatory guidance 
that CMS will issue as described in this 
final rule with comment period. 
Moreover, to the extent permitted by 
Federal law, we do not intend to make 
public a particular provider or 
supplier's screening level assignment. 

Comment: A commenter requested 
that CMS expand the limited screening 
level defined in the proposed regulation 
to include the term “non-physician 
practitioner." This term is frequently 
used to describe nurse practitioners, 
clinical nurse specialists, and 
physicians’ assistants. 

Response: This regulation uses the 
term “non-physician practitioner" in 
describing categories of providers 
assigned to a level of screening. See 
§424.518(a){t)(i). 

Comment: A commenter 
recommended that, to the extent 
allowed under law, CMS disclose 
limited information about the risk 
model so as to avoid reverse-engineering 
by individuals intent on defrauding the 
Medicare program. 

Response: We appreciate this 
comment, but believe it is important 
that the provider and supplier 
communities be made aware of what 
will be required as part of the 
enrollment process. 

Comment; A commenter 
recommended that reimbursement be 
provided for the cost of the background 
check and fingerprint card. With budget 
cuts and regulatory mandates, providers 
are struggling to meet the increasing 
costs of delivering health care services 
in an environment with decreasing 
resources. Another commenter 
suggested, however, that fingerprinting 
be done at the cost of the provider prior 
to the Medicare contractor receiving the 
enrollment application. 

Response; A fingerprint-based 
criminal history record check is part of 
the Medicare enrollment screening 
process for specified applicants. The 
cost of the having the fingerprints taken 
and supplying the fingerprints to the 
authorized channeler, whether 
electronic or on the card, will be borne 


by the provider or supplier. There will 
be no cost to the provider or supplier for 
the subsequent processing of the prints 
or the background check, as CMS will 
pay for the processing of the prints and 
the criminal history record check. 

Comment: A commenter 
recommended that providers be able to 
have their fingerprints electronically 
scanned with a vendor contracting with 
the Federal government. 

Response; Shortly after the 
publication of this final rule with 
comment period, we will be issuing 
guidance to the provider and supplier 
communities regarding the processes for 
obtaining fingerprints. We anticipate 
that CMS will contract with an FBI- 
approved authorized channeler for the 
collection and transmission of 
fingerprints. It is our understanding that 
such authorized channelers use 
electronic technology to collect and 
process fingerprints. We will provide 
more information regarding available 
technologies and vendors prior to the 
implementation of this requirement, as 
announced 60 days prior to the effective 
date through the publication of 
subregulatory guidance. 

Comment; A commenter stated that 
CMS needs to ensure that Information 
used in the classification of suppliers is 
correct and appropriate. Thus, CMS 
should require that only final agency 
actions be used as a basis for assigning 
suppliers. Decisions overturned on 
appeal should have no bearing or effect 
on the supplier's screening level. 

Response: We do not believe it is 
appropriate to wait until a particular 
action is final before shifting a provider 
into a different screening level. The 
appeals process can take an extended 
period, during which a provider intent 
on deftauding the Medicare program 
could have more time to do so if 
permitted to remain in a lower 
screening level. As already mentioned, 
should a particular action be rescinded, 
the provider will be restored to its 
previous screening level. 

Comment: A commenter stated that 
pharmacies licensed by the State — 
whether newly enrolling or as part of an 
additional location — should be specified 
as limited risk providers. 

Response; As we mentioned earlier. 
State licensure is not automatically 
indicative of the screening level that 
should be ascribed to a category of 
provider or supplier. 

Comment: A commenter questioned 
whether hospice organizations are 
correctly included within the moderate 
screening level and should instead be 
included in the limited screening level. 
The commenter did not believe that 
sufficient data exists to justify placing 
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hospices in the moderate screening 
level. 

flesponse; For the reasons we 
explained, we believe that hospices are 
most appropriately as assigned to the 
moderate screening level. 

Comment: A commenter stated that if 
an enrollment moratorium were placed 
on a particular geographic area and then 
lifted, the Medicare contractor would be 
required to conduct background checks 
and fingerprints on all physicians in 
that area. The commenter urged CMS to 
reconsider the burdens and costs of 
doing so for large groups of providers. 
The delays in processing these 
applications would deter physicians 
from enrolling and revalidating their 
enrollments. The commenter also stated 
that CMS should limit those physicians 
placed in the highest level of screening 
to individuals previously found guilty 
of crimes against Medicare or where 
there is publicly available evidence to 
justify such intrusions. 

Response; The situation described in 
the commenter's first sentence would 
only apply in the unlikely event that 
physicians in that area were subject to 
a moratorium. As stated earlier, CMS 
does not believe that the collection of 
the fingerprints for the FBI fingerprint- 
based criminal history record check will 
substantially impact the time to process 
an enrollment application by the 
relevant Medicare contractor. If, as will 
most likely be the case with any 
temporary enrollment moratorium, the 
moratorium only applies to non- 
physician provider or supplier types, 
physicians would not be affected by the 
lifting of the moratorium. We believe we 
have clarified this point in the final rule 
with comment period. 

Comment: Regarding fingerprinting 
and background checks, a commenter 
requested clarification regarding: (1) 
How the information will be stored and 
whether it will be destroyed after a 
period of time; ( 2 ) how the information 
will be used; {3} what constitutes 
background information that rises to the 
level of a threat to Medicare; (4) whether 
the physician or non-physician 
practitioner be afforded a copy of the 
results; (5) the policies that will ensure 
that the information is protected and 
secure and, in the event of a security 
lapse, whether the practitioner will be 
notified: (6) who will be conducting the 
background checks: (7) whether the 
information will be added to State or 
Federal databases for other purposes; 
and (8) whether practitioners will know 
prior to or at the time of application 
submission that they will be subject to 
these additional requirements. 

Response: We have clarified in this 
final rule with comment period that the 
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fingerprint requirement will be used in 
the context of obtaining FBI criminal 
history record Information. This 
information will be stored according to 
all Federal requirements as well as the 
FBI’s Security and Management Control 
Outsourcing Standard for Channelers 
and Non-Channeiers and the CJIS 
Security Policy, CMS will rely on 
existing authority to deny and revoke 
enrollment at § 424.530(a} and 
§ 424.535(a) if an individual who 
maintains a 5 percent or greater direct 
or indirect ownership interest in a 
provider or supplier has certain prior 
felony convictions, or if an enrollment 
application contains false or misleading 
information. The FBI will send the 
results of the criminal history record 
check only to the authorized channeler, 
who will be permitted to send the 
results only to the authorized recipient, 
or an FBI approved outsourced third 
party. In the event of loss of the criminal 
history record reports, CMS will follow 
the established protocol for 
communicating with the public and 
individuals regarding the loss of 
personally identifiable information. The 
criminal history record information is 
compiled when the FBI receives the 
fingerprint and links it to an existing 
recordfs) of arrest and prosecution in 
State and FBI databases. Individuals or 
entities do not conduct criminal 
background checks. CMS, through an 
authorized channeler. will be accessing 
existing law enforcement data on 
fingerprinted individuals as required by 
this final rule with comment period. 
CMS will inform all relevant 
individuals of their requirement to 
submit fingerprints for the purposes of 
an FBI criminal history check as a 
condition of enrollment. While we are 
finalizing this screening method, we do 
not plan to implement this provision 
upon the effective date. Instead, we will 
be issuing additional guidance to 
providers, suppliers, the general public, 
and our contractors after the publication 
of this final rule with comment period 
to explain the operational aspects of the 
fingerprint-based criminal history 
record check requirement. As stated 
previously, we will delay 
implementation until 60 days after the 
publication of subregulatory guidance. 

Comment: A commenter asked who 
will pay the fee for the fingerprinting 
and, if the physician or practitioner 
must pay it, whether he or she will be 
reimbursed, given the restrictions on 
application fees for certain non- 
institutional providers. 

Response; The relevant individuals 
who are required to undergo the 
criminal history record check will incur 
the cost of having their fingerprints 


taken. Providers and suppliers will not 
be reimbursed by Medicare, Medicaid or 
CHIP for the fingerprint collection costs. 
CMS will bear the cost of processing the 
fingerprint-based criminal history 
record check for providers and suppliers 
that enroll in Medicare. For Medicaid- 
only and CHIP-only providers, the 
States and Federal government will 
share these costs. 

Comment: A commenter stated that 
fingerprinting is generally limited to 
certain hours of the day. Due to the 
demands of physicians’ schedules, the 
commenter asked how CMS will ensure 
the availability of fingerprinting for 
those physicians placed in the high 
screening level. 

Response; Physicians who are 
enrolled in Medicare as practicing 
physicians will generally not be subject 
to fingerprinting. Fingerprint-based 
criminal history record checks will only 
be required in the case of providers or 
suppliers that are assigned to the high 
screening level. Physicians are generally 
assigned to the limited screening level. 

Comment; A commenter urged CMS 
to ensure that fingerprinting and 
background checks do not delay the 
enrollment of legitimate and honest 
physicians. 

Response: Physicians are generally 
assigned to the limited screening level 
and, as such, will not be subject to 
fingerprinting based on their enrollment 
as a physician. Physicians who choose 
to enroll as DMEPOS suppliers or HHAs 
will be required to undergo a 
fingerprint-based criminal history 
record check as a requirement of the 
high screening level but, as stated 
previously, CMS does not believe this 
requirement will significantly delay tlie 
enrollment of any provider or supplier. 

Comment: A commenter .stated mat 
hospital-owned HHAs and hospices 
should be designated as limited risk 
and, therefore, should not be subject to 
unannounced and unscheduled pre- 
enrollment and/or post-enrollment 
onsite visits. 

Response; For the reasons already 
discussed, newly enrolling HHAs will 
be placed in the high screening level, 
regardless of ownership. 

Comment: Several commenters stated 
that implementing the new screening 
procedures by March 23. 2011 is not 
feasible due to the coordination efforts 
required between Medicare and 
Medicaid, They recommended that the 
implementation date be moved to March 
23. 2012. 

Response: We disagree, and believe 
that all screening procedures except the 
fingerprint-based criminal history 
record check required for those in the 
high level of screening will be in place 
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beginning on March 25, 2011. As noted 
previously, we will delay 
implementation of such high screening 
level until 60 days after the publication 
□f subregulatory guidance on how this 
provision will be implemented. Further, 
we believe the statute requires the 
implementation dales that we have 
specified. 

Comment,- A commenter 
recommended that CMS reconsider the 
risks associated with allowing existing 
enrollees to be exempted from the new 
screening procedures until March 23, 
2012, The commenter believes this 
creates a potential gap in program 
integrity. 

Response: The ACA specifies the 
effective dates for the new screening 
provisions. For newly enrolling 
providers and suppliers, and for those 
currently enrolled whose revalidation is 
scheduled between March 25, 2011 and 
March 23, 2012, the effective date is 
March 23, 2011 or the date scheduled 
for the revalidation, For providers and 
suppliers assigned to the high screening 
level, the fingerprint-based criminal 
history record check requirement will 
be implemented through subregulatory 
guidance and will be effective 60 days 
following the publication of the 
guidance. All other screening 
requirements are effective on March 25, 
2011 for those in the high screening 
level. For all other currently enrolled 
providers and suppliers, the statute 
established an effective date of March 
23, 2012. 

Comment.- A commenter 
recommended simplifying the screening 
process such that ail enrolling providers 
and suppliers are put into the moderate 
level, and then adjust screening 
interventions based on specific 
circumstances related to elevated risk of 
fraud. 

Response: We decline to base the 
assignment of provider and supplier 
types to a level of screening on the 
assumption that every provider or 
supplier is of equal risk upon 
enrollment into the Medicare. We see 
clear differences in risk among 
categories of providers and snppiiers. 
Therefore, we do not plan to assign all 
provider and supplier categories to the 
same screening level, In response to the 
suggestion that we adjust screening 
interventions based on specific 
circumstances, we believe this process 
is both unwieldy and burdensome to 
implement for every provider as the 
baseline screening methods, Although 
we have identified certain events that 
will cause a provider to move from 
“limited” or “moderate” to “high” 
screening, we do not believe we should 
conduct individual assessments. As 


stated previously, CMS will assess an 
individual provider’s risk and potential 
actions based on the individual 
provider’s enrollment application and 
may continue to use existing program 
integrity tools that are not addressed by 
this rule. We believe this approach is 
the most objective approach and is 
consistent with the ACA. 

Comment; A commenter requested 
clarification on how States will be 
notified of providers’ risk classifications 
and any changes thereto. 

Response: We will disseminate 
guidance to the States on this topic 
shortly after the publication of this final 
rule with comment period. 

Comment: A commenter 
recommended that CMS explain 
whether it is replacing or removing the 
current revalidation basis in 
§ 424.53S(a}(6) with the proposed new 
§ 424.535(aK6). 

Response; We are neither replacing 
nor removing the current revalidation 
basis. We simply proposed an 
additional reason at § 424.53S(a)(6](i) for 
the revocation of Medicare billing 
privileges- Specifically, we proposed 
that billing privileges may be revoked if 
“An institutional provider does not 
submit an application fee or hardship 
exception request that meets the 
requirements set forth in §424.514 with 
the Medicare revalidation application,” 
or the hardship exception is not granted. 
We will renumbor the subsections in 
§424.S3S(a) accordingly. 

The commenter refers to the current 
revalidation basis but cites to the 
revocation regulation. To clarify, as 
stated previously, the proposed rule 
proposed to require that a provider or 
supplier revalidate its enrollment at any 
time pursuant to §424.515- This new 
authority to permit off-cycle 
revalidations does not replace the 
current cycle for revalidation (3 years 
for DMEIPOS and 5 years for all other 
providers). 

Comment: To reduce the paperwork 
burden imposed on providers and 
suppliers and to reduce the 
administrative expense associated with 
processing a revalidation application, 
several commenters recommend that 
CMS allow providers and suppliers in 
good standing to submit an annual 
attestation, rather than a full 
revalidation application. The 
attestation, in other words, would be 
used in lieu of revalidation, and would 
require the provider or supplier to 
notify CMS of eny changes or to attest 
that there were no changes within the 
prior year. This approach would 
promote compliance without requiring 
the provider or supplier to submit a full 
revalidation application and a fee. 


Response: The burden associated with 
submitting Medicare enrollment 
applications A, B, I, R and CMS-855S 
is currently approved under Office of 
Management and Budget (0MB) control 
numbers 0938-0685 and 0938-1057, 
respectively. Such an attestation, as 
proposed by the commenter, would not 
fulfill the screening requirements of this 
final rule with comment period, as re- 
screening is a condition of revalidation. 
The screening requirement and 
associated application fee are required 
by the ACA to minimize the risk of 
fraud, waste and abuse to the Medicare, 
Medicaid programs and CHIP, and 
cannot be circumvented by a process 
that would limit the scope of such 
screenings. 

Comment: One commenter stated that 
CMS did not furnish sufficient 
justification or rationale for its proposal 
in §424.515 that CMS may require a 
provider or supplier to revalidate its 
enrollment at any time. The commenter 
added that the proposed revision seems 
punitive and overly broad because CMS 
does not furnish ample discussion for 
the public to fully evaluate the proposal. 
The commenter recommended that CMS 
remove its proposal because CMS did 
not: (1) Justify its reasons for 
establishing this new authority, (2) 
describe its existing authorities and how 
this proposal is different, and (3) 
explain or justify the number of times 
that CMS can require revalidation 
within a given period of time. 

Response: We proposed at §424.515 
that we have the ability to require that 
a provider or supplier revalidate its 
enrollment at any time, and stated that 
this proposal was designed to help 
ensure that the statutory effective date 
of March 23. 2013 is met, We fully 
intend to implement the new authorities 
provided by the ACA by the deadlines 
that have been set out by the Congress. 

We stated in the proposed rule that 
DMEPOS suppliers are required to re- 
enroll every 3 years, and other providers 
and suppliers are required to revalidate 
their enrollment every 5 years. For 
purposes of clarity, we also proposed 
language at § 424.57 (b) that changes all 
references to “re-enroll” or “re- 
enrollment” to “revalidate” or 
“revalidation.” We have existing 
authority at § 424.515(d) to require off- 
cycle validations in addition to the 
regular 5 year revalidations and may 
request that a provider or supplier 
recertify the accuracy of the enrollment 
information when warranted to assess 
and confirm the validity of the 
enrollment information maintained by 
us. Such off-cycle revalidations may be 
triggered as a result of random checks, 
information indicating local health care 
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fraud problems, national initiatives, 
complaints, or other reasons that cause 
us to question the compliance of the 
provider or supplier with Medicare 
enrollment requirements. Off cycle 
revalidations may be accompanied by 
site visits. The new authority to conduct 
off-cycle validations of providers and 
suppliers will enable us to apply the 
new screening requirements to all 
currently enrolled providers and 
suppliers by the statutory effective date. 

The proposed rule stated that once a 
provider has been subject to an off-cycle 
validation under §424.5l5(e), the 
current cycle for revalidation would 
apply. This means that if a provider 
subject to the 5-year revalidation cycle 
had to revalidate in 2013, the provider 
or supplier would next have to 
revalidate in 2018. However, a provider 
or supplier may be required to 
revalidate under §424.515(dl during 
that time period if there are indicators 
of the noncompliance for a particular 
provider. 

Comment; A commenter stated that 
CMS currently requires contractors to 
review State licensing board data on a 
monthly basis, As such, it would be 
more efficient to access a centralized, 
federated database to provide CMS with 
the most comprehensive data on 
physician licensure status. 

Response: As previously mentioned, 
we are currently in the process of re- 
assessing the provider enrollment 
process and systems that are used to 
support screening and enrollment. We 
are exploring a number of options to 
take advantage of technological 
advances to improve the provider 
screening process. Increased automation 
of the process is one of the areas on 
which we are focusing. 

Comment; A commenter stated that, 
given the ongoing Medicare backlogs, 
CMS should provide information 
regarding: (1) The number of 
revalidations started and completed by 
CMS or its contractors in 2007, 2008, 
2009, and 2010, (2) how an estimated 
93,000 revalidations per year beginning 
in 2010 will impact the processing of 
new applications by providers and 
suppliers, and (3) the amount of money 
obligated on provider screening 
activities for each fiscal year between 
2005 and 2010, and (4) how much 
money CMS expects to obligate for these 
activities in 2011. Another commenter 
recommended that CMS furnish the 
number of revalidation applications 
processed by the National Supplier 
Clearinghouse, MACa, carriers, and 
fiscal intermediaries for each of the last 
5 years. 

Response: This final rule with 
comment period specifically increases 


the number of providers and suppliers 
that will be revalidated through the use 
of off-cycle revalidations, for the 
explicit purpose of applying the new 
screening requirements to currently 
enrolled providers. Therefore, the 
number of revalidations processed in 
the past 4 or 5 years and the money 
obligated to that process is irrelevant to 
the evaluation of our ability to process 
additional revalidations as required by 
this final rule with comment period. 
Additionally, we have under^ken steps 
to streamline the enrollment process, 
both for newly enrolling and 
revalidating providers and suppliers. 

We recognize that there have been 
challenges in implementing the new 
authorities to safeguard the integrity of 
Medicare, Medicaid and CHIP, and have 
demonstrated a willingness to work 
with providers and suppliers to reduce 
unnecessary burdens and risks that may 
have accompanied the enrollment 
processes in the past. We have 
communicated with providers via 
Medicare Learning Networks and 
provider Open Door Forums, and will 
continue to do so throughout the 
implementation of the ACA. 

We believe that additional resources 
will be available to enable the 
processing of the increased numbers of 
enrollment applications. We have 
actively taken steps to reduce 
processing times as much as feasible. 
Furthermore, we have undertaken many 
activities to streamline the enrollment 
process to reduce the burden upon 
providers and suppliers. 

Comment: A commenter 
recommended that CMS employ an 
expanded data-driven screening process 
by using open-source data during the 
enrollment and re-enrollment business 
processes. Such data could include the 
current operational status of the firm; 
chain of ownership or corporate family 
linkages; identification of tax liens; 
presence of open bankruptcies; and 
records of government enforcement 
actions. The commenter also suggested 
that each provider and supplier be 
registered for post-enrollment data 
monitoring, which “pushes” one or more 
high risk updates (for example, 
bankruptcy filing: a criminal filing 
involving a provider executive; or 
sudden increase in the risk of financial 
failure) to CMS automatically. CMS 
could use such high risk alerts (or the 
selection and prioritization of 
unscheduled and unannounced site 
visits. Finally, the commenter 
recommended additional database 
checks that would vary by screening 
level. These included, but were not 
limited to, verifying: (1) Corporate chain 
of ownership, (2) tax liens, (3) non-HHS 


government enforcement actions, (4) 
extent of any government contracting, 
and (5) any open lawsuits. 

Response: As stated previously, we 
are continually exploring additional 
improvements to our data systems. We 
are committed to working with both 
private and public partners to continue 
to evaluate technologies that can 
provide the scalability and safeguards to 
beneficiary access that we need to 
ensure accurate payments to legitimate 
providers for appropriate services. 

Comment: A commenter urged CMS 
to release a proposal for comment that 
provides additional detail regarding 
what CMS believes should constitute 
background information relevant to 
Medicare provider enrollment that 
would prevent a practitioner from 
enrolling in the Medicare program. 

flesponse; At some point it may be 
necessary to modify our existing 
regulations that address felonies that are 
relevant to enrollment of billing 
privileges. However, we have not yet 
proposed expansion of our existing 
authorities codified in the Code of 
Federal Regulations. The requirements 
for Medicare enrollment are established 
in other regulations and manual 
instructions, and are not — unless 
otherwise stated herein — ^being modified 
in this final rule with comment. The 
criminal background check is intended 
to verify certain information provided 
on the Medicare enrollment application. 
Under our existing regulatory authority, 
we could impose a denial of enrollment 
or a revocation of billing privileges 
based upon the results of the 
background check in certain instances. 
Illustratively, if, through the background 
check, CMS learned of a felony 
conviction that met the criteria at 
§ 424, 530(a)(3) or § 424,535(aK3). billing 
privileges could be denied or revoked, 
respectively. 

Commenf: Oue commenter stated that 
in its FY 2011 performance budget, we 
say that we will create a limited number 
of MACS to carry out provider 
enrollment, and that each contractor 
would enroll providers for designated 
regions of the country. Given the 
publication of the proposed rule, the 
commenter recommended that we 
explain how reducing the number of 
MACs and increasing the workload will 
help providers and suppliers and reduce 
Medicare fraud, waste, and abuse in the 
Medicare program. The commenter also 
requested that CMS furnish an update 
on this consolidation effort. Another 
commenter asked CMS to explain how 
it will consolidate provider enrollment 
activities, conduct 93,000 ravalidations, 
and handle initial applications without 
disrupting the provider enrollment 
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process and creating additional backlogs 
and processing delays for providers of 
service and suppliers. 

Response: We recognize that provider 
enrollment is a large and complicated 
task that requires not only internal 
consistency but also understanding and 
ease of interaction with the provider 
and supplier community. As a result, 
we are currently engaged in a thorough 
assessment of the provider enrollment 
process and in making improvements as 
needed to eliminate delays in 
enrollment and improve overall system 
performance. As part of this process, we 
are working toward consolidation of the 
number of enrollment contractors as a 
means to achieve economy of scale and 
greater consistency in the enrollment 
process. In developing the provisions of 
this final rule with comment period and 
other regulatory and subregulatory 
policies, we are mindful of the overall 
re-assessment of the provider 
enrollment process and supporting 
systems- 

Comment: A commenter urged CMS 
to refine its provider enrollment 
specialty categories to accurately reflect 
the existing varieties of practitioners — 
particularly the categories for dentistry 
and the dental specialties — in order to 
reduce the likelihood that practitioners 
such as dentists will be inappropriately 
categorized and subject to unwarranted 
higher levels of screening. 

Response: We do not believe it is 
necessary to further refine the provider 
enrollment specialty. Dentists should 
submit the CMS-855I if they intend to 
submit claims directly to Medicare. 
Further, dentists would be in the 
limited screening level, 

Comment; A commenter stated that 
the proposed rule does little to prevent: 
(1) Identity theft; (2) health care h'aud; 
(3) money laundering; and (4) bank 
fraud, The commenter believes that the 
screening levels were too broad and 
simplistic. To prevent fraud and abuse, 
the commenter recommended that CMS: 
{!) Implement section 6401(aK3) of the 
ACA immediately; (2) consider and 
adopt distinct screening criteria and 
program requirements for non-physician 
owners of medical clinics and that these 
providers be placed into a high 
screening level, and (3) use the statutory 
authority in section 6401(aK3) of the 
ACA to make sure that the claims being 
submitted are valid. 

Response: We believe the commenter 
is referring to new section 1866(j)(3) of 
the Act. which addresses a provisional 
period of enhanced oversight for new 
providers of services or suppliers. We 
will implement all authorities granted 
under the ACA using the proper 
procedures, We disagree with the 


commenter that the proposed rule and 
this final rule with comment period will 
do little to prevent health care fraud, 
and believe that issues of money 
laundering and bank fraud are beyond 
the scope of this final rule with 
comment period. We strongly believe 
that additional site visits, both 
announced and unannounced, will help 
to identify fraudulent providers and 
suppliers before they are permitted to 
enroll in Medicare, Medicaid or CHIP. 
The temporary moratoria and payment 
suspension provisions give us the 
ability to act as soon as a problem is 
detected, preventing money from being 
paid while balancing the rights and 
needs of providers, suppliers, and 
beneficiaries. 

Comment: One commenter stated that 
CMS’s proposed ability to reenroll 
DMEPOS suppliers more frequently 
than every three years could be 
burdensome for CMS and the DMEPOS 
supplier, and suggested that CMS 
revalidate every 3 years from the most 
recent revalidation, rather than every 3 
years from the date billing privileges 
were granted. 

Response; As stated previously, the 
proposed rule and this final rule with 
comment period permit us to require 
revalidation of DMEPOS suppliers on or 
after March 23. 2012 to meet the 
statutory effective date for the screening 
requirements; after that, DMEPOS 
suppliers would then be subject to 
revalidalion every 3 years. DMEPOS 
could be subject to off-cycle revalidation 
under existing authority at §424.515(d) 
when CMS has reason to question the 
compliance of the provider or supplier 
with Medicare enrollment requirements. 

Comment; One commenter stated that 
identity theft is a huge problem in the 
United States and that Medicare, 
Medicaid and CHIP should do 
everything possible to protect 
physicians’ identities. The commenter 
recommended that CMS provide data on 
the number of physicians and non- 
physician practitioners who have 
practice locations in multiple States — 
including States with connecting State 
boundaries and States without 
connecting State boundaries. The 
commenter also suggested that CMS 
explain what efforts, if any. are used to 
verify a physician that is establishing a 
practice location in multiple States and 
that the individual’s identity is 
authenticated. Another commenter 
stated that it is unclear how 
fingerprinting and background checks 
will achieve the goal of preventing 
identity theft for physicians. 

Response: We agree with the 
comment that Medicare, Medicaid and 
CHIP should use ail available 


authorities to protect physicians’ 
identities. However, as we have noted 
previously, we will not use this 
screening regulation to identify 
instances of identity theft. We disagree 
that the publication of the number of 
physicians and non-physician 
practitioners who have practice 
locations in multiple States will address 
the issue of identity theft. We also have 
a process in place to verify a physician 
is legitimately establishing practice 
locations in multiple States, and have 
found there are multiple legitimate 
reasons why this may be the case. 

We believe that criminal history 
record checks will enable us to verify 
information that has been submitted on 
an enrollment application is accurate 
and complete. As stated previously, 
using fingerprints to perform such a 
record check is the only accepted 
method by the FBI for non-criminal 
justice purposes, as it is believed to be 
the most accurate link between an 
individual and their criminal history 
record, 

Comment; A commenter stated that in 
the proposed rule, CMS does not justify 
or explain the rationale for many of its 
positions, such as; (1) Placing providers 
and suppliers into various screening 
categories, and (2) its rationale for 
creating a new revalidation reason [see 
§ 424.515(e)). The commenter 
recommended that CMS not finalize this 
proposed rule, but rather publish a new 
proposed rule using the information 
from this rule. 

Response; We disagree that the 
proposed rule did not explain our 
rationale for our approaches. As 
mentioned earlier, we relied on our 
extensive experience to identify 
categories of providers with a higher 
incidence of fraud, waste and abuse. In 
addition, we used the expertise of our 
contractors charged with identifying 
and investigating instances of 
fraudulent billing practices in making 
our decisions regarding the appropriate 
risk classification of various providers, 
In some instances, we also relied on the 
data analysis and expertise of the DIG, 
GAO, and other sources to develop a 
process designed to increase scrutiny for 
specific categories of providers and 
suppliers that represent a higher risk to 
the Medicare program. Furthermore, we 
stated the new reason for off-cycle 
validation is to enable us to apply the 
new screening requirements to all 
applicable providers and suppliers by 
the statutory effective date of March 23, 
2013. 

Comment; In response to a request for 
comments, a commenter stated Qiat 
harmonization between Medicare, 
Medicaid, and MA would be beneficial 
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only to the extent that the programs 
have enrollment and re-validation 
reciprocity and that adequate resources 
and time were allocated to ensure that 
harmonization does not wreak havoc 
among state Medicaid programs and MA 
plans. Reciprocity would ensure that 
physicians are not subject numerous 
times to the same or similar onerous 
requirements; this would also represent 
significant savings for Federal health 
care programs. 

Response: We agree that 
harmonization between program 
requirements will be beneficial for State 
Medicaid agencies, providers, and CMS. 
This final rule with comment period 
implements several changes that 
minimize the burden on State.? and 
providers, including the reciprocity of 
Medicare screening for dually enrolled 
providers and State responsibility to 
screen only Medicaid and CHIP-only 
providers. 

Comment: A commenter requested 
special consideration and/or 
exemptions for States with 
comprehensive licensure statutes for 
orthotists and prosthetists. 

Response; We do not agree that 
licensed orthotists and prosthetists 
should receive special consideration or 
exemptions as compared to orthotists 
and prosthetists that happen to be 
located in a State without what could be 
deemed ‘non-comprehensive’ licensure 
statutes. CMS did not make a distinction 
based on licensure requirements for any 
other category of provider. 

Comment; A commenter opposed the 
proposed language at §424.51S(e) 
allowing CMS to require additional off- 
cycle revalidations, stating it could 
allow CMS to initiate revalidations 
frequently and on a whim. At a 
minimum, off-cycle revalidations 
should be exempt from the $500 
iication foe. 

esponse: We disagree with this 
comment. Section 424.515(e) was added 
for a specific purpose and we could not 
require a provider or supplier to 
revalidate off-cycle pursuant to 
§ 424.515(e) more than once. The 
application fee was included in the 
statute to cover exactly the type of 
screenings that will be performed 
during the revalidations, and we do not 
believe it is appropriate or necessary to 
exempt the revalidations from the fee. 

Comment: A commenter suggested 
that CMS tie an enrollment ban to those 
who are trying to enroll in the Medicare 
program and not just for those who are 
already enrolled. That way, fraudulent 
providers would never be allowed to 
enter the program, 

Response: We believe the commenter 
is referring to an enrollment bar for 


providers and suppliers whose 
applications are denied, similar to that 
which is currently in place for providers 
and suppliers whose Medicare billing 
privileges are revoked. We appreciate 
this suggestion. We are currently not in 
a position to adopt it, as additional 
research is needed to determine its 
potential effectiveness and the various 
circumstances under which it might 
apply. That said, we may consider it as 
part of a future rulemaking effort. 

c. Final Screening Provision — Medicare 

This final rule with comment period 
finalizes the provisions of proposed rule 
in regards to the Medicare screening 
requirements with the following 
modiRcations: 

• In § 424.518(a}(l}, we are adding 
Competitive Acquisition Program/Part B 
Vendors to the limited risk screening 
level. 

• In §424.538{a)(l), we are adding 
pharmacies that are newly enrolling or 
revalidating via the CMS-855B to the 
“limited” level of screening. 

• In § 424.518(a)(l}, in response to 
comments, we have changed the 
description for Indian health service 
providers to state, “health programs 
operated by an Indian Health Program 
(as defined In section 4(12) of the Indian 
Health Care Improvement Act) or an 
urban Indian organization (as defined in 
section 4(29) of the Indian Health Care 
Improvement Act) that receives funding 
from the Indian Health Service pursuant 
to Title V of the Indian Health Care 
Improvement Act, hereinafter {IHS 
facilities)." 

• In 424.518(a)(2), we are clarifying 
that occupational therapy and speech 
pathology providers are assigned to the 
limited screening level. 

• In 424.518(al(l), we are removing 
physical therapists and physical 
therapist groups ft-om the category of 
non-physician practitioners that aro 
within the limited screening level. 

• In 424.518(a)(1), we are removing 
non-public, non-government owned or 
affiliated ambulance suppliers from the 
limited screening level. 

• In §424. 5l8Ta)(2). we are adding 
portable x-ray suppliers to the moderate 
screening level. 

• In 424.518(a)(2), we are adding 
physical therapists and physical 
therapist groups to the moderate 
screening level. 

• In 424.518(a)(2), we are assigning 
all ambulance suppliers to the moderate 
screening level, regardless of whether 
they are public or government affiliated. 

• In §424.518{aKl), we are adding 
pharmacies that are newly enrolling or 
revalidating via the CMS— 855B to the 
limited screening level. 


• In §424.518, we also eliminated the 
distinction between: (1) Publicly traded 
and non-publicly traded, and 

(2) publicly owned and non-publicly 
owned as criteria for assignment of any 
provider type to a level of screening. 

• In §424.518(c){2)(ii)(A), we have 
removed the requirement that 
fingerprints must be submitted using the 
FD-258 fingerprint card. Also, the 
fingerprints must be collected from all 
individuals who maintain a 5 percent or 
greater direct or indirect ownership 
interest in the provider or supplier. 

• In §424.51B(c)(2)(ii)(B), we have 
replaced “conducts a criminal 
background check” with “Conducts a 
fingerprint-based criminal history report 
check of the Federal Bureau of 
Investigations Integrated Automated 
Fingerprint Identification System on all 
individuals who maintain a 5 percent or 
greater direct or indirect ownership 
interest in the provider or supplier.” 

■ In § 424.518(d). we have identified 
owners with a 5 percent or greater direct 
or indirect ownership as responsible for 
providing fingerprints, and the 
methodology of how to submit the 
fingerprints. 

• § 424.518(c)(3). we have added 
“final adverse action” as a basis for 
reassigning a provider or supplier to the 
high screening level at 
§424.518(c)(3)(i{i)(B). 

• In §424. 518(c)(3), we have added 
six months as the length of time a 
provider or supplier category will be 
assigned to the high screening level 
following the lifting of a temporary 
enrollment moratorium. 

■ Finally, in § 424.518(c)(3), we have 
removed denial of Medicare billiDg 
privileges in the previous ten years as a 
basis for reassigning a provider or 
supplier to the nigh screening level at 
§424.518{c){3)0ii)(B). 

As we have stressed throughout this 
preamble, we will monitor these new 
procedures and their effectiveness and 
may reconsider or modify our approach 
in the future as we gain experience with 
these procedures. We further reiterate 
that nothing in this rule is intended to 
abridge our established screening 
authority under existing statutes and 
regulations, or to diminish the screening 
that providers and suppliers currently 
undergo. The provisions specified in 
this final rule with comment period are 
intended to enhance — not replace — our 
existing authority. The screening laid 
out here reflects the minimum 
requirements. For example, a contractor 
may undertake database checks in 
addition to the ones listed below as 
deemed appropriate. Nothing in this 
rule should be interpreted as limiting 
the amount of scrutiny CMS or its 
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contractors may give to an applicant. levels of screening by category that we 
Tables 5 through 8 below outline the are finalizing. 


Table 5— Final Level of Required Screening for Medicare Physicians, Non-Physician Practitioners, 

PROVIDERS, AND SUPPLIERS 


Type of screening required 

Limited 

Moderate | 

i High 

Verification of any provider/supplier-specific requirements estatMished by Medicare 

X 

X 

X 

Conduct license verifications, (may include licensure checks a^oss States) 

X 

X 

X 

Database Checks (to verify Social Security Number (SSN); the National Prot^er Identifier 
(NPI); the National Practitioner Data Bank (NPDB) licensure; an OIG exclusion; taxpayer 
identification number; death of individual practitioner, owner, auttwrized ofltcial, delegated 
official, or supervising physician 

X 

X 

X 





Fingerpdnt-Based Criminal History Record Check of law enforcement repositories 



X 


Table 6— -Final Medicare Pro- 
viders AND Suppliers Categories 
Designated to the “Limited” 
Level for Screening Purposes 


Provider/supplier category 


Physician or non-physician practitioners and 
medical groups or clinics, with the excep- 
tion ot physical therapists and physical 
therapist groups. 

Ambulatory surgical centers, competitive ac- 
quisition program/Part B vendors, 
end-stage renal disease facilities. Federally 
qualified health centers, histocompatibility 
laboratories, hospitals, including critical ac- 
cess hospitals, Indian Health Service facili- 
ties. mammography screening centers, 
mass immunization roster billers, organ 
procurement organizations, pharmacies 
newly enrolling or revalidating via the 
CMS-655B, radiation therapy centers, reli- 
gious non-medicat health care institutions, 
rural health clinics, and skilled nursing fa- 
cilities. 


Table 7— Final Medicare Pro- 
viders AND Suppliers Categories 
Designated to the “Moderate” 
Level for Screening Purposes 


Provider/supplier category 


Ambulance suppliers, community mental 
health centers; comprehensive outpatient 
rehabilitation facilities; hospice organiza- 
tions; independent diagnostic testing facili- 
ties; independent clinical laboratories; 
physical therapy including physical therapy 
groups and portable x-ray suppliers. 

Currently enrolled (revalidating) home health 
agencies. 


Table 8 — Final Medicare Pro- 
viders and Suppliers Categories 
Designated to the “High” Level 
FOR Screening purposes 


Provider/supplier category 


Prospective (newly enrolling) home health 
agencies and prospective (newly enrolling) 
suppliers of DMEPOS. 


4. General Screening of Providers — 
Medicaid and CHIP — ^Proposed 
Provisions and Analysis of and 
Responses to Public Comments 
Section 1902(kk}{l) of the Act 
requires that States comply with the 
process for screening providers 
established by the Secretary under 
section 1866(j}(2) of the Act.^ Section 
2107(e)(1) of the Act provides that all 
provisions that apply to Medicaid under 
sections 1902(a)(77) of the Act,® the 
State plan mandate for compliance with 
provider and supplier screening, 
oversight, and reporting requirements In 
accordance with 1902();)t}, and 1902(kk) 
of the Act, the specific State plan 
requirements regarding provider and 
supplier screening, oversight, and 
reporting, shall apply to CHIP. We 
proposed in new §457.990 that all the 
provider screening, provider 
application, and moratorium regulations 
that apply to Medicaid providers will 
apply to providers that participate in 
CHIP. In addition, in this final rule with 
comment period, we refer to State 
Medicaid agencies as responsible for 
screening Medicaid-only providers. In 
some States, CHIP is not administered 
by the Medicaid agency. Throughout 
this final rule with comment period, 
with respect to those instances. “State 
Medicaid agency” should be read to 
encompass “Children’s Health Insurance 
Program agency” where the two are 
separate entities. 

Because it would be inefficient and 
cosily to require States to conduct the 
same screening activities that Medicare 
contractors perform for dually-enrolled 
providers, we proposed that a State may 
rely on the results of the screening 
conducted by a Medicare contractor to 


* As noted previously, we believe that Ihe 
reference to section IBSSQUZ) of the Act in section 
6401(b)(t) of the ACA is a scrivener's error, and that 
the Congress intended to refer instead to section 
1866(j](Z)of the Act. 

Section 1902{a}(77) is only broadly referenced in 
the final rogulstions under section §455.400. as a 
statutory section being implemented by Ihe 
regulation. 


meet the provider screening 
requirements under Medicaid and CHIP. 
Similarly, we proposed in §455.410 that 
Stale Medicaid agencies may rely on the 
results of the provider screening 
performed by the State Medicaid 
programs and CHIP of other States. For 
Medicaid-only providers or CHIP-only 
providers, we proposed that States 
follow the same screening procedures 
that CMS or its contractors follow with 
respect to Medicare providers and 
suppliers. 

As previously noted, section 
1902(kk)(l) of the Act requires ihatState 
screening methods follow those 
performed under the Medicare program. 
For the sake of brevity, we will not 
restate those methods verbatim, We 
proposed that States follow the rationale 
that we have set forth for Medicare in 
section I1.A.3. of this final rule with 
comment period, and that we use as the 
basis for § 455.450. For the types of 
providers that are recognized as a 
provider or supplier under the Medicare 
program. States will use the same 
screening level that is assigned to that 
category of provider by Medicare. For 
those Medicaid and C^HIP provider types 
that are not recognized by Medicare, 
States will assess ihe risk posed by a 
particular provider or provider type, 
States should examine their programs to 
identify specific providers or provider 
types that may present increased risks of 
fraud, waste or abuse to their Medicaid 
programs or CHIP. States are uniquely 
qualified to understand issues involved 
with balancing beneficiaries' access to 
medical assistance and ensuring the 
fiscal integrity of the Medicaid programs 
and CHIP. However, where applicable, 
wa expect that States will assess the risk 
of fraud, waste, and abuse using similar 
criteria to those used in Medicare. For 
example, physicians and non-physician 
practitioners, medical groups and 
clinics that are State-licensed or State- 
regulated would generally be 
categorized as limited risk. Those 
provider types that are generally highly 
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dependent on Medicare, Medicaid and 
CHIP to pay salaries and other operating 
expenses and which are not subject to 
additional government or professional 
oversight would be considered moderate 
risk, and those provider types identified 
by the State as being especially 
vulnerable to improper payments would 
be considered high risk. States will then 
screen the provider using the screening 
tools applicable to that risk assigned. 
However, we did not propose to limit or 


otherwise preclude the ability of Slates 
to engage in provider screening 
activities beyond those required under 
section ia6G()}(2} of the Act, including, 
but not limited to, assigning a particular 
provider type to a higher screening level 
than the level assigned by Medicare. 

As with the proposed screening 
provisions for Medicare, we solicited 
comments on the applicability of these 
proposals for Medicaid as well. We 
solicited comment on the proposed 


assignment of specific provider types to 
established risk categories, including 
whether such assignments should be 
released publicly, whether they should 
be reconsidered and updated according 
to an established schedule, and what 
criteria should be considered in making 
such assignments. 

Based on the level of screening 
assigned to a provider or provider type, 
we proposed that States conduct the 
following screenings: 


Table 9 — Proposed Level of Risk and Required Screening for Medicaid and CHIP Providers 


Type of screening required 


Verification of any provider/supplter-specific requirements estabtisPed by Medicaid/CHIP 

Conduct license verifications (may include licensure checks across State Ikies) 

Database Checks (to verify SSN and NPi, the NPDB, licensure, a HHS OIG exclusion, tax- 
payer identification, tax delinquency, death of individual practitioner, and persons with an 
ownership or control interest or who are agents or managing employees of the provider) ... 

Unscheduled or Unannounced Site Visits 

Criminal Background Check 

Fingerprinting 


Limited 

Moderate 

X 

X 

X 

X 

X 

X 


X 




High 


X 

X 


X 

X 

X 

X 


Not all States routinely require 
persons with an ownership or control 
interest or who are agents or managing 
employees of the provider to submit 
SSNs or dates of birth (DOBs). Without 
such critical personal identifiers, it is 
difficult to be certain of the identity of 
persons with an ownership or control 
interest or who are agents or managing 
employees of the provider, and it may 
be difficult for States to conduct the 
screening proposed under this rule. 
Accordingly, and to be consistent with 
Medicare requirements, pursuant to our 
general rulemaking authority under 
section 1102 of the Act, we proposed in 
§455.104 to require that States will 
require submission of SSNs and DOBs 
for all persons with an ownership or 
control interest in a provider. In 
addition to the amendment to §455.104, 
we proposed to revise that section for 
the sake of clarity both for the disclosing 
entities’ provision and the States’ 
collection of the disclosures. We 
recognize that there may be privacy 
concerns raised by the submission of 
this personally identifiable information 
as well as concerns about how the States 
will assure individual privacy as 
appropriate: however, we believe this 
personally identifiable information is 
necessary for States to adequately 
conduct the provider screening 
activities under this final rule with 
comment period. We solicited comment 
specifically on this issue. 

Although the level of screening may 
vary depending on the risk of fraud, 
waste or abuse the provider represents 
to the Medicaid program or CHIP, under 
section 1866(|](2)(B)(i) of the Act, all 


providers would be subject to licensure 
checks. Therefore, we proposed that 
States be required to verify the status of 
a provider’s license by the State of 
issuance and whether there are any 
current limitations on that license. 

As stated previously, pursuant to 
section 2107(e)(1) of the Act. all 
provisions that apply to Medicaid under 
sections 1902(a)(77) and 1902(kk) of the 
Act apply to CHIP. Because we 
proposed a new regulation in Part 457 
under which all provider screening 
requirements that apply to Medicaid 
providers would apply to providers that 
participate in CHIP, these requirements 
for provider screening and assigning of 
categories of risk of fraud, waste, or 
abuse, as well as verification of 
licensure, under §455.412 and 
§455,450 will apply in CHIP. 

Comment.- Commenters expressed 
concerns about new and existing 
disclosure requirements under 
§ 455.104, including our proposal to add 
to the disclosure requirements 
collection of SSNs and DOBs of persons 
with an ownership or control interest in 
the disclosing entity. Some States 
support the proposal, already having 
instituted the disclosure requirement in 
their enrollment application procedures. 
Other States support the proposal but 
request additional time for 
implementation, including forms and 
system dianges. Two States expressed 
concern about the impact the 
requirement might have upon 
beneficiary access to providers. 

Response: We will not address the 
comments directed at the existing 
language of § 455.104. The regulation 


was rearranged for ease of application 
by States and disclosing entities, but 
with the exception of the addition of 
SSNs and DOBs, as well as changes 
suggested by a few commenters 
regarding corporate entity addresses and 
familial relationships, the language is 
substantially unchanged horn the 
language currently in effect. We 
acknowledge the commenters’ concerns 
about collection of SSNs and DOBs, 
however, collection of SSNs and DOBs 
is necessary to complete the screening 
process and be certain of the identity of 
the party being screened, We recognize 
that the addition of SSNs and DOBs and 
other improvements in disclosure 
collection will require systems and 
forms changes and States will need time 
for implementation. We encourage 
States to contact us about their specific 
timeframes. Furthermore, we do not 
believe that this requirement will have 
an adverse impact on beneficiary access 
as the majority of disclosure 
requirements have not changed, and our 
experience with the same requirement 
in Medicare indicates that such a 
requirement does not adversely impact 
beneficiary access. 

Comment: Other commenters made 
recommendations on language changes 
that would clarify § 455.104(b){lKi} 
regarding the address of corporate 
entities with ownership or control of 
disclosing entities; § 455.104(b)(2) 
regarding familial relationships; and 
§ 455.104(b)(4) regarding SSNs and 
DOBs of managing employees. 

Response: We agree with the 
commenters that §455.104(b)(l)(i) 
should be clarified regarding addresses 
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of corporate entities with ownership or 
control of disclosing entities and 
accordingly will revise §455.104(bKl){i) 
to clarify from whom the name and 
address must be provided and to require 
the disclosing entity to supply primary 
business address as well as every' 
business location and P.O. Box address, 
if applicable. We agree that 
§ 455.104(b){2) should be clarified 
regarding to whom the spouse, parent, 
child, or sibling is related, and we are 
revising § 455.104(b)(2) accordingly. We 
agree that § 455.104(b)(4) should be 
clarified to require managing employees 
to provide SSNs and DOBs, as that was 
the intent of the proposal, and we are 
revising § 455.104(b)(4) accordingly. 

Comment: Several commenters 
expressed concern regarding collection 
of disclosures under §455.104. One 
commenter expressed concern about the 
confidentiality and privacy of board 
member identity and the protection 
from disclosure to the general public. 
Other commenters were concerned that 
not-for-profit board members were 
volunteers and might not serve were 
they compelled to provide their SSNs 
and DOBs as a condition of the entity 
being enrolled. 

Response: We have previously 
provided guidance to States that 
§455.104 requires disclosures firom 
persons with ownership and control 
interests in the disclosing entity, which 
includes officers and directors of a 
disclosing entity that is organized as a 
corporation, without regard to the for- 
profit or not-for-profit status of that 
corporation. That guidance is available 
at bttp://www.cms.gov/ 
FraudAbuseforProfs/Downioads/ 
bppedisclosure.paf. We are sensitive to 
the concerns related to confidentiality of 
identifiable information such as SSNs. 
We are also concerned about issues that 
arise out of identity theft. We encourage 
States to institute appropriate 
safeguards to protect the information 
they gather as required by these rules. 
However, collection of disclosures 
including the SSNs and DOBs of 
persons with ownership and control 
interests in a disclosing entity, and of 
managing employees, is necessary to 
protect the integrity of the State 
Medicaid programs. Therefore, we are 
finalizing the proposal requiring 
provision of SSNs and DOBs. 

Comment: One commenter sought 
clarification whether the disclosure 
requirements in § 455,104 apply to IHS 
providers. 

Response.' This rule does not make 
any changes about whom disclosures 
must be provided, but rather simply 
adds additional items of information 
that must be disclosed, The boards of 


IHS facilities were not previously 
subject to the — disclosure requirements 
in §455.104, and accordingly, are not 
subject to the additional disclosure 
requirements imposed by this rule. 

Comment; Commenters expressed 
concern about the applicability of 
§ 455.104 to public school districts. 
Public schools deliver Medicaid school 
based health services to Medicaid 
eligible children and therefore are 
enrolled as Medicaid providers. The 
commenters objected to the proposed 
requirement in § 455.104 that the 
schools provide the SSNs and DOBs of 
persons with controlling interests of the 
provider, which they interpreted to 
include the SSNs and DOBs of school 
board members. The majority of the 
commenters stated that the public 
school districts were closely regulated 
by numerous checks and balances and 
there was a low likelihood that fraud 
would be perpetrated in schools, 
therefore, the collection of SSNs and 
DOBs from public school districts was 
unnecessary. 

Response; As previously noted, this 
rule does not change about whom 
disclosures must be provided, but rather 
what information must be disclosed. 
Except to the extent that any public 
school districts may be organized as 
corporations, they were not previously 
required to make disclosures about their 
boards, nor are they required to under 
this new rule. 

Comment: Several commenters 
expressed concern regarding the license 
verification requirement in §455.412. 
One commenter noted that it would be 
administratively inefficient, costly, and 
unrealistic for States to verify eac^ 
provider applicant’s licensure status in 
another State. Another commenter 
offered that searching its database 
containing multi-State licensure data 
would be more efficient than requiring 
States to search State by State. 

Response: Holding a valid 
professional license should be a 
prerequisite in any State prior to 
assignment of a Medicaid provider 
identification number. Medicaid 
beneficiaries have a right to be treated 
only by those providers that have been 
deemed by the licensing boards of their 
States to be eligible to treat them. As a 
matter of public policy, it is not 
unreasonable to expect that licensure 
status of all in-State and out-of-State 
providers be checked prior to 
enrollment, and that any limitations on 
their licenses be checked as well. Out- 
of-State provider applicants submit 
licensure information including status 
to the Medicaid agency with their 
application. While verification of out-of- 
State licensure may be challenging, all 


those Medicaid agencies that enroll out- 
of-State providers have the obligation to 
verify licensure status of out-of-State 
providers as well. We appreciate the 
commenter’s suggestion of its database 
of provider information. We are aware 
that State licensing boards maintain 
publicly available information that 
neighboring States may access. It is 
within the States' discretion which 
databases to check. 

Comment: A commenter requested 
clarification of whether license 
verification was required when the chart 
at 75 FR 58214 states that license 
verification “may include licensure 
checks across State lines” thereby 
implying that licensure checks across 
State lines are permissive, not 
mandatory. 

Response; The Slate Medicaid agency 
must verify the licensure of a provider 
applicant in the State in which the 
provider applicant purports to be 
licensed. If an out-of-State provider 
submitted an application for enrollment, 
the State Medicaid agency would be 
required to verify license across State 
lines. 

3. Database Checks — Medicaid and CHIP 

States employ several database 
checks, including database checks with 
the Social Security Administration and 
the NPPES, to confirm the identity of an 
individual or to ensure that a person 
with an ownership or control interest is 
eligible to participate in the Medicaid 
program. 

A critical element of Medicaid 
program integrity is the assurance that 
persons with an ownership or control 
interest or who are agents or managing 
employees of the provider do not 
receive payments when excluded or 
debarred from such payments. 
Accordingly, in § 455.436, we proposed 
that States be required to screen all 
persons disclosed under § 455.104 
against the OIG's LEIE and the General 
Services Administration's EPLS. We 
proposed that States be required to 
conduct such screenings upon initial 
enrollment and monthly thereafter for as 
long as that provider is enrolled in the 
Medicaid program. 

We also proposed at § 455.450, as well 
as § 455.436, that database checks be 
conducted on all providers on a pre- 
and post-enrollment basis to ensure that 
providers continue to meet the 
enrollment criteria for their provider 
type. 

As previously stated, pursuant to 
section 2107(e)(1) of the Act, all 
provisions that apply to Medicaid under 
sections 1902(a)(77) and 1902(kk) of the 
Act also apply to CHIP. Because we 
proposed a new regulation in Part 457 
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under which all provider screening 
requirements that apply to Medicaid 
providers will apply to providers that 
participate in CHIP, this requirement for 
database checks under § 455,436 and 
§ 455.450 apply in CHIP. 

We received many comments on the 
database requirements in §455,436 from 
States concerned about the 
administrative burden presented by 
searching several databases upon 
enrollment, and both the LEIE and the 
EPLS on a monthly basis by the names 
of both the provider and those with 
ownership or control interests in the 
provider and managing employees of 
the provider. 

Comment: Some commenters 
questioned whether there were costs 
associated with accessing the databases. 
The commenters suggested that CMS 
establish a centralized database that 
States could access, including using an 
automated, rather than manual, search, 
all at no cost to States. One State 
suggested that the databases be 
accessible through automated data 
exchanges and that any cost to the 
States be waived to avoid barriers to 
compliance with the rule. Two other 
States questioned whether there were 
costs associated with accessing the 
databases that must be considered. 

Other commenters suggested a delay or 
elimination of the proposed requirement 
at § 455.436(c)(2) until CMS established 
such a centralized database. 

Response: We are aware that there 
may be costs to the State Medicaid 
agency associated with checking some 
databases. However, § 455.436 
enumerates databases that most State 
Medicaid agencies already check in 
their routine provider enrollment 
operations. In addition, we have 
previously issued guidance to State 
Medicaid Directors recommending 
searching the LEIE on a monthly basis 
by the names of enrolled providers and 
for providers, by the names of their 
employees and contractors. Those 
guidance documents are available here: 
http://www.cms.gov/smdi/downloads/ 
SMD061208.pdf and http:// 
www.cms.gav/SMDL/downIoads/ 
SMD011609.pdf. Many States have 
already adopted the recommendations 
in their enrollment policies. More 
recently, in September 2010, we 
provided guidance to program integrity 
directors on the availability of the LEIE 
and EPLS for exclusion searches. That 
guidance document is available here; 
h Up :/ / WWW, cms.go v/ 
FroudAhusejorProfs/Downloads/ 
bppedisciosure.pdf. 

Accordingly, we are finalizing 
§ 455.436 to require State Medicaid 


agencies to conduct Federal database 
checks, 

Comment: A commenter questioned 
whether other databases will be 
prescribed In the final rule with 
comment period or whether States will 
be notified of requirements in another 
fashion. 

flesponse: In § 455.436(b), we 
proposed that the States be required to 
check "any such other databases as the 
Secretary may prescribe.” We are not 
prescribing additional databases in the 
final rule with comment period. 
However, in response to evolving 
circumstances, the Secretary may issue 
guidance to States regarding checking 
specific databases. 

Comment: One commenter sought 
clarification on which of a provider’s 
managing employees the State Medicaid 
agency must search in the exclusions 
databases. The commenter noted that 
some large providers like hospitals have 
many managing employees that may be 
subject to the proposed database checks. 

flesponse; We recognize the burden 
that conduct of database checks of 
managing employees may pose for 
providers with managing employees at 
multiple levels or locations in its 
organizations. Nevertheless, database 
checks must be conducted for all 
persons disclosed under §455.104, 
including managing employees who 
could compromise or place in jeopardy 
a provider's compliance with Medicare, 
Medicaid, or CHIP requirements. 

Comment: One commenter noted that 
State vital statistics information may be 
more accurate than the Social Security 
Administration’s Death Master File. The 
commenter suggested allowing States to 
check against their own vital records 
systems and not require the States to 
check against the Social Security 
Administration’s file. 

Response: While on an anecdotal 
basis State records may be more 
accurate than the Social Security 
Administration’s Death Master Pile, it is 
the Death Master File that is the 
national file of record. Therefore, we are 
finalizing the requirement that State 
Medicaid agencies check the Social 
Security Administration’s Death Master 
File. However, under § 455.436(c)(1) a 
State may also consult other appropriate 
databases to confirm identity upon 
enrollment and reenrollment. 

Comment: Another commenter noted 
that the Social Security Administration 
only allows SSN verification for W-2 
purposes. The commenter 
recommended removing the reference to 
checks of “applicable” Social Security 
Administration databases horn the 
database check requirement. 


Response: We express no opinion as 
to the accuracy of the commenter’s 
statement regarding SSN verification, 
but agree with the commenter that the 
database check requirement in this rule 
should be more explicit. Accordingly, 
we are revising §455.436 to indicate a 
check of the “Social Security 
Administration’s Death Master File” 
rather than “applicable databases”. 

Comment: A few commenters 
requested clarification regarding which 
database States must check for 
verification of tax identifications and 
tax delinquencies and how the States 
would use that information as a tool for 
screening providers. 

flesponse; Although we believe that 
verifying taxpayer identification and 
checking for tax delinquencies may be 
useful indicators of fraud to a State 
Medicaid program, access to that 
information is limited and mey not be 
feasible in the short term, Therefore, we 
are not finalizing those requirements as 
suggested by Table 5 under “Type of 
Screening Required”. 

Comment: One commenter asked 
whether it was our intention to require 
providers also to check their employees 
for exclusions on a monthly basis. The 
proposed regulation at §455.436 does 
not require providers to check their 
employees for exclusions. 

nesponse: We issued guidance on 
June 12, 2008, to State Medicaid 
Directors recommending that they check 
their enrolled providers for exclusions 
on a monthly basis. We followed up that 
guidance on January 16 , 2009, with 
guidance to State Medicaid Directors 
recommending that they require their 
enrolled providers to check the 
providers’ employees and contractors 
for exclusions on a monthly basis. 

Those letters are available at; http:// 
www.cms.gQv/smdl/downloQds/ 
SMD061208.pdf and http:// 
www.cms.gov/SMDL/downloads/ 
SMD0JJ609.pdf. Many States made our 
recommendations their policy. 

Section 455,436 does not mandate 
that States require their providers to 
check the LEIE and EPLS on a monthly 
basis to determine whether the 
providers' employees and contractors 
have been excluded. We do. however, 
recommend that States consider making 
this a requirement for all providers and 
contractors, including managed care 
contractors in their Medicaid programs 
and CHIP. 

b. Unscheduled and Unannounced Site 
Visits — Medicaid and CHIP 

Section 1866(j}(2)(B)(!i)(in) of the Act 
states that the Secretary, based on the 
risk of fraud, waste, and abuse, may 
conduct unscheduled and unannounced 
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site visits, including pre-enrollment site 
visits, for prospective providers and 
those providers already enrolled in the 
Medicare and Medicaid programs and 
CHIP. 

Some States already require site visits, 
often for provider categories at 
increased risk of fraud, waste or abuse, 
such as home health and non- 
emergency transportation. According to 
FY 2008 State Program Integrity 
Assessment (SPIA) data, at least 16 
States report that they perform some 
type of site visits. However, such efforts 
vary widely across the country and are 
subject to budget shortfalls. 

We proposed to require in §455,432 
and § 455.450(b) that States must 
conduct pre-enrollment and post- 
enrollment site visits for those 
categories of providers the State 
designates as being in the “moderate” or 
“high” level of screening. 

Further, in § 455.432, pursuant to our 
general rulemaking authority under 
section 1102 of the Act, we proposed 
that any enrolled provider must permit 
the State Medicaid agency and CMS, 
including CMS’ agents or its designated 
contractors, to conduct unannounced 
on-site inspections to ensure that the 
provider is operational at any and all 
provider locations. 

We maintain that site visits are 
essential in determining whether a 
provider is operational at the practice 
location found on the Medicaid 
enrollment agreement. We expect these 
requirements to increase the number of 
both pre-enrollment and post- 
enrollment site visits for those provider 
types that pose an increased financial 
risk of fraud, waste, or abuse to the 
Medicaid program, 

We proposed that failure to permit 
access for site visits would be a basis for 
denial or termination of Medicaid 
enrollment as specified in §455.416. 

As stated previously, pursuant to 
section 2107(e)(1) of the Act, all 
provisions that apply to Medicaid under 
sections I902{a}(77) and 1902(kk) of the 
Act apply to CHIP. Because we 
proposed a new regulation in Part 457 
under which all provider screening 
requirements that apply to Medicaid 
providers will apply to providers that 
participate in CHIP, this requirement for 
site visits under § 455,432 apply in 

CHIP. 

Comme/if; Some commenters were 
supportive of the proposal for pre- 
enrollment and post-enrollment site 
visits in § 455.432. although they noted 
that they would need additional funding 
for travel or for contractors to conduct 
the site visits. Some commenters stated 
that the States should have the 
discretion to define which providers are 


subject to pre- and post-enrollment site 
visits and when the site visits are 
conducted, for example, by established 
risk categories or an automatic flag that 
demonstrates that billing has gotten to a 
certain threshold thus requiring an 
onsite visit. A few commenters stated 
that the site visits were an undue 
burden on States. One commenter stated 
that the site visits were unnecessary 
given that other more cost-effective 
methods could prevent enrollment of 
providers who are using fraudulent 
identity, such as annual re-enrollment, 
license verification, and follow-up when 
a duplicate provider ID or address is 
used. Another commenter noted that 
pre-enrollment site visits could delay 
enrollment as a result of inclement 
weather. 

Response: We recognize that conduct 
of site visits will place a burden on State 
budgets and staff time, and may be 
difficult to accomplish in rural areas or 
in inclement weather. However, site 
visits are a requirement depending on 
the risk the provider represents to the 
Medicaid program. In response to the 
commenters that suggested that States 
should have the discretion to define 
which providers are subject to pre- and 
post-enrollment site visits; The site 
visits are required for those providers 
that are determined to be a moderate or 
high categorical risk of fraud, waste, or 
abuse. In addition to the required site 
visits for providers in the moderate and 
high screening levels, the State may also 
conduct site visits at its discretion. 

While there may be other means to 
verify whether a provider is a going 
concern or whether a provider has a 
business location, conduct of site visits 
is one method that is required by this 
regulation. The State has the discretion 
to utilize other additional methods to 
prevent enrollment of non-existent 
providers or to ensure that spurious 
applications are not processed. 

Comment; A few commenters sought 
clarification on what the expectations 
were for site visits when the provider 
performed services in the beneficiary’s 
home, for example, personal care 
services: or for out-of-State providers or 
rural providers. 

Hesponse; If a Medicaid-only provider 
is in the moderate or high screening 
level, the State Medicaid agency does 
not have the discretion whether to 
conduct a site visit: It is required under 
§ 455.432(a) and §455,45od»). However, 
pursuant to § 455.452, States are 
permitted to establish additional or 
more stringent screening measures than 
those required by this final rule with 
comment period. Thus, for providers 
that are in the limited screening level, 
the State has the discretion to determine 


whether to conduct site visits, based on 
whatever factors the State deems 
appropriate. We recognize that the 
appropriate location of the site visit may 
differ based upon the provider type. For 
example, the personal care services 
agency is the enrolled provider, so its 
location would likely be subject to a site 
visit. While its employee the personal 
care attendant may not be an enrolled 
provider with the State Medicaid 
agency, it may also be appropriate to 
conduct a site visit in a beneficiary’s 
home where the personal care attendant 
is providing services to ensure that 
services are in fact being provided 
appropriately. It would be within the 
discretion of the State Medicaid agency 
to determine whether to conduct an 
additional site visit for a provider in the 
limited screening level. With respect to 
providers in rural locations, the mere 
fact that the provider is in a rural 
location does not absolve the State 
Medicaid agency of its responsibility to 
conduct site visits. Similarly, for out-of- 
State providers, the mere fact that a 
provider in the moderate or high 
screening level is located in another 
State would not negate the requirement 
for a site visit, although we note that 
§ 455.410 permits States to rely upon 
the screening performed by Medicare 
and by other State Medicaid programs 
and CHIP. Therefore, no additional site 
visit would be required if the provider 
is also enrolled by Medicare or in 
Medicaid or CHIP in its home State, 
c. Provider Enrollment and Provider 
Termination — Medicaid and CHIP 

States may refuse to enroll or may 
terminate the enrollment agreement of 
providers for a number of reasons 
related to a provider’s status or history, 
including an exclusion from Medicare, 
Medicaid, or any other Federal health 
care program, conviction of a criminal 
offense related to Medicare or Medicaid, 
or submission of false or misleading 
information on the Medicaid enrollment 
application, Failure to provide 
disclosures is another reason for 
termination from participation in the 
Medicaid program. 

Federal regulations beginning at 
§ 455,100 require certain disclosures by 
providers to States before enrollment. 
States require additional disclosures 
prior to enrollment. Some States require 
periodic re-enrollment and disclosure at 
that time. However, States vary in the 
frequency of such re-disclosures, 
Providers are also inconsistent in 
keeping their enrollment information 
current, including items as elementary 
as their address. 

We proposed, at §455.414, pursuant 
to our general rulemaking authority 
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under section 1102 of the Act, that all 
providers undergo screening pursuant to 
the procedures outlined herein at least 
once every 5 years, consistent with 
current Medicare requirements for 
revalidation. 

In § 455.416, we proposed to establish 
termination provisions, requiring States 
to deny or terminate the enrollment of 
providers; (1) Where any person with an 
ownership or control interest or who is 
an agent or managing employee of the 
provider does not submit timely and 
accurate disclosure information or fails 
to cooperate with ail required screening 
methods: (2) that are terminated on or 
after January 1, 2011 by Medicare or any 
other Medicaid program or CHIP (see 
section II.F, of this final rule with 
comment period): and (3) where the 
provider or any person with an 
ownership or control interest or who is 
an agent or managing employee of the 
provider fails to submit sets of 
fingerprints within 30 days of a State 
agency or CMS request. We proposed to 
permit States to deny enrollment to a 
provider if the provider has falsified any 
information on an application or if CMS 
or the State cannot verify the identity of 
the applicant. We also proposed to 
require States to deny enrollment to 
providers, unless States determine in 
writing that denial of enrollment is not 
in the best interests of the State’s 
Medicaid program, in these 
circumstances: (1) The provider or a 
person with an ownership or control, 
interest or who is an agent or managing 
employee of the provider fails to 
provide accurate information; (2) the 
provider fails to provide access to the 
provider’s locations for site visits, or (3) 
the provider, or any person with an 
ownership or control interest, or who is 
an agent or managing employee of the 
provider has been convicted of a 
criminal offense related to that person's 
involvement in Medicare, Medicaid, or 
CHIP in the last 10 years. We believe 
that providers can significantly reduce 
the likelihood of fraud, waste or abuse 
by providing and maintaining timely 
and accurate Medicaid enrollment 
information. We believe the Medicaid 
program will be better protected by not 
allowing persons with serious criminal 
offenses related to Medicare, Medicaid, 
and CHIP to serve as providers. 

We proposed at § 455.416 that the 
State be allowed to deny an initial 
enrollment application or agreement 
submitted by a provider or terminate the 
Medicaid enrollment of a provider, 
including an individual physician or 
non-physician practitioner, if CMS or 
the State is not able to verify an 
individual’s identity, eligibility to 
participate in the Medicaid program, or 


determines that information on the 
Medicaid enrollment application was 
falsified. 

In § 455.420, we proposed to require 
that any providers whose enrollment 
has been denied or terminated must 
undergo screening and pay all 
appropriate application fees again to 
enroll or re-enroll as a Medicaid 
provider. 

We proposed at § 455.422 that in the 
event of termination under § 455.416, 
the State Medicaid agency must give a 
provider any appeal rights available 
under State law or rule. 

As stated previously, pursuant to 
section 2107(e)(1) of Act. ail 
provisions that apply to Medicaid under 
sections 1902{a)(77) and 1902(kk) of the 
Act apply to CHIP. Because we 
proposed a new regulation in Part 457 
under which all provider screening 
requirements that apply to Medicaid 
providers will apply to providers that 
participate in CHIP, these requirements 
for provider enrollment, provider 
termination, and provider appeal rights 
under §455.414, §455.416, §455.420, 
and § 455.422 apply in CHIP. 

Comment: Several commenters 
expressed concern regarding the 
requirement under § 455.414 related to 
a 5 year re-screening process. Some 
commenters stated that they already 
required a periodic re-enrollment 
process and CMS should take into 
consideration the States’ existing 
processes and grant the States the 
flexibility to employ those existing 
processes. 

Other commenters noted that the 
additional enrollments would place 
administrative and fiscal burdens on the 
States. Several commenters noted that 
they would need an extended period to 
implement the new requirements of the 
proposed rule, including the 
requirement set forth at §455.414. 

One commenter sought clarification 
whether all providers currently enrolled 
and that have been enrolled for 5 years 
would be up for revalidalion when the 
regulation became effective; and 
whether currently enrolled providers 
could be revalidated over a 5-year 
timeframe to diminish the 
administrative burden on State 
Medicaid agency staff. 

Another commenter sought 
clarification whether the requirement 
was for re-screening or for re-enrollment 
at least every 5 years; whether the 
requirement would apply to all enrolled 
providers including rendering 
providers, or just to ordering or referring 
physicians and other professionals who 
are the subject of the requirements set 
forth at § 455.410 and § 455.440; and 


whether CMS would give affected 
providers notice of the need to re-enroll. 

Response: Periodic re-validation of 
enrollment information affords States 
the opportunity to ensure their provider 
rolls do not contain providers that have 
been excluded from participation in the 
Federal health care programs. The State 
Medicaid agencies can cull from their 
provider rolls those providers that have 
not submitted claims for payment or 
referred claims for payment in several 
years. Without removing those 
providers' numbers during a periodic re- 
enroHment process, those providers' 
numbers might be used at a later date in 
a fraudulent scheme: The providers may 
have been unwitting victims of identity 
theft or may have participated in selling 
their provider numbers. 

The proposed requirement at 
§ 455.414 describes screening of all 
providers at least every 5 years. 
Screening, as performed by the 
Medicare Administrative Contractors for 
all dually participating providers, and 
by the State Medicaid agency or CHIP 
for those providers that are not also 
participating in the Medicare program, 
should be distinguished from 
enrollment, a function performed by the 
State Medicaid agency or CHIP to 
participate in the Medicaid program or 
CHIP of a given State, Screening would 
involve various assessments 
commensurate to the risk the provider 
posed to the Medicaid program or CHIP, 
including license verification, database 
checks, site visits, background checks, 
and fingerprinting. Enrollment may 
involve all of those, as well as collection 
of disclosures required under § 455.104, 
§ 455.105, and §455.106, and a host of 
State-specific requirements. 

We applaud States that already 
require periodic re-enrollment of 
Medicaid providers. For the sake of 
consistency with the Medicare program, 
however, we are finalizing §455.414 as 
a 5 year re-validation of enrollment 
information, which includes re- 
screening as well as the collection of 
updated disclosure information, for 
providers regardless of provider type, 
including, but not limited to, rendering, 
ordering, and referring physicians, and 
other professionals. The screening 
component of the 5 year re-validation 
will be conducted by either the 
Medicare Administrative Contractors 
(for dually-participating providers) or by 
the States (for Medicaid-only or CHIP- 
only providers). The collection of 
updated enrollment information, 
including, but not limited to, disclosure 
information will be the province of the 
State Medicaid agencies, and subject to 
their existing procedures, therefore, we 
will not issue notices of the need to 



221 


Federal Register/ Vol. 76, 


revalidate enrollment information to the 
affected providers. 

Slate Medicaid agencies should 
complete the first re-validation cycle by 
2015, with 20 percent of providers being 
re-validated each year beginning 2011. 
State Medicaid agencies have the 
discretion to determine which providers 
or provider types to re-validate 
enrollment first. However, they may 
want to consider re-validating 
enrollment in the first years of the cycle 
those providers or provider types that 
pose the greatest risk of fraud, waste or 
abuse to the Medicaid program and 
CHIP. 

Comment; We received comments 
from States supportive of the proposed 
bases for denial of enrollment or 
termination of enrollment in § 455.416, 
but concerned about the time they 
would need for implementation to 
amend State laws and rules and to 
amend provider agreements. One State 
commented that it would be 
administratively inefficient, costly, and 
unrealistic for each State to 
independently confirm providers’ 
enrollment status or termination history 
in another State’s Medicaid program or 
CHIP. 

Response,' We believe that the bases 
for denial of enrollment or termination 
of enrollment in § 45S.416 are necessary 
to protect the integrity of the Medicaid 
program. Therefore, prompt 
implementation of these additional 
bases for denial or termination will 
serve each State and Medicaid programs 
nationally. We acknowledge the 
additional burden that new bases for 
denial and termination will create for 
State Medicaid programs, for example, 
in changes to systems and forms, and 
changes to provider agreements, We are 
currently examining to what extent we 
can support a centralized information 
sharing solution for provider enrollment 
across programs and across States. 
However, we note that termination 
based on termination by Medicare or by 
another State’s Medicaid program is a 
statutory requirement effective January 
1 . 2011 . 

Comment: One commenter 
recommended that the reasons for 
provider termination should be outlined 
and given to the provider upon denial 
or termination. The commenter noted 
that the provider would then have the 
ability to address or correct deficiencies 
prior to resubmitting its enrollment 
application. This requirement, the 
commenter noted, would be in addition 
to any appeal rights. 

Response; We have provided for a 
right of appeals to the extent they are 
available under a State’s existing laws or 
rules. While we recognize that the 
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commenter's suggestion may be helpful, 
and States may elect to ado^ it, we will 
not be disrupting a State’s procedures 
under its existing laws or rules with this 
regulation. 

Comment: One State recommended an 
addition to the language of 
§455.416(gKl}tci recognize that a 
provider’s omissions may be as 
egregious as its falsified statements. 

Response: We appreciate the 
commenter's suggestion to cover all 
possible situations when a provider may 
have misled the State In the application 
process. However, §45S.4t6(d) 
addresses termination for a failure to 
submit timely and accurate information 
which would include omissions to 
provide information. Therefore we 
decline to revise section § 455.416(g)(1). 

Comment: A State requested 
clarification on how rigorous the State's 
efforts must be to verify the identity of 
the provider applicant or whether a 
background check is sufficient. 

Response; The State Medicaid 
agencies have the discretion to 
determine the steps that are appropriate 
to verify the identity of the provider 
applicant, which may include, but 
would not be limited to. verification of 
licensure, database checks, and criminal 
background checks. 

d. Criminal Background Checks and 
Fingerprinting — Medicaid and CHIP 

Section 1866(j)(2)(B)(ii)(II) of the Act 
allows the Secretary to use 
fingerprinting during the screening 
process; and while several States have 
implemented procedures to require 
fingerprinting of physicians and non- 
physician practitioners as a condition of 
licensure, we maintain that if a State 
designates a provider as within the high 
level of screening as described 
previously, each person with an 
ownership interest in that provider 
should be subject to fingerprinting. 

Adding fingerprinting to State 
screening processes for those providers 
that pose the greatest risk to the 
Medicaid program will allow CMS and 
the State to: (1) Verify the individual’s 
identity; (2) determine whether the 
individual is eligible is participate in 
the Medicaid program; (3) ensure the 
validity of information collected during 
the Medicaid enrollment process; and 
(4) prevent and detect identity theft. 
Ensuring the identify of "high” risk 
Medicaid providers through 
fingerprinting protects both the 
Medicaid program and providers whose 
identities might otherwise be stolen as 
part of a scheme to defraud Medicaid. 

In addition, while §455.106 requires 
providers to submit information to the 
Medicaid agency on criminal 


convictions related to Medicare and 
Medicaid and title XX, current 
regulations do not require States to 
verify data submitted as part of the 
Medicaid enrollment application and 
they are sometimes not able to verify 
information that was purposefully 
omitted or changed in a manner to 
obfuscate any previous criminal 
activity. According to fiscal year (FY) 
2008 SPIA data, at least 20 States report 
that they conduct some type of criminal 
background check as part of their 
Medicaid enrollment practices. 

Elements of a robust criminal 
background check could include, but 
not are necessarily limited to: (1) 
Conducting national and State criminal 
records checks; and (2) requiring 
submission of fingerprints to be used for 
conducting the criminal records check 
and verification of identity. 

We proposed in § 455.434 and 
§ 455.450 for those categories of 
providers that a State Medicaid agency 
determines is within the high level of 
screening, the State must; (1) Conduct a 
criminal background check of each 
provider and each person with an 
ownership or control interest or who is 
an agent or managing employee of the 
provider, and ( 2 ) require that each 
provider and each person with an 
ownership or control interest or who is 
an agent or managing employee of the 
provider to submit his or her 
hngerprints. The State Medicaid agency 
has the discretion to determine the form 
and manner of submission of 
fingerprints. 

At §455.434. we proposed that the 
State Medicaid agency must require 
providers or any person with an 
ownership or control interest or who is 
an agent or managing employee of the 
provider to submit fingerprints in 
response to a State’s or CMS’ request. 

We solicited public comment on the 
appropriateness of using criminal 
background checks in the provider 
enrollment screening process, including 
the instances when such background 
checks might be appropriate, the 
process of notifying a provider or 
individual that a criminal background 
check is to be performed, and the 
frequency of such checks- 

We also solicited comment on the use 
of fingerprinting as a screening measure. 
We recognize that requesting, collecting, 
analyzing, and checking fingerprints 
from providers are complex and 
sensitive undertakings that place certain 
burdens on affected individuals. There 
are privacy concerns and operational 
concerns about how to assure individual 
privacy, how to check fingerprints 
against appropriate law enforcement 
fingerprint data bases, and how to store 
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the results of the query of the databases 
and also how to handle the subsequent 
analysis of the results. As a result, we 
solicited comments on how CMS or a 
State Medicaid agency should maintain 
and store fingerprints, what security 
processes and measures are needed to 
protect the privacy of individuals, and 
any other issues related to the use of 
fingerprints in the enrollment screening 
process, We expressed interest in 
comments on this and other possible 
circumstances in which fingerprinting 
would be potentially useful in provider 
screening or other fraud prevention 
efforts. Our proposed screening 
approach contemplated requesting 
fingerprints from providers assigned to 
the high level for screening. We 
solicited comments on whether this is 
an appropriate requirement, the 
circumstances under which it might be 
appropriate or inappropriate, and any 
alternatives to the proposed approach 
regarding fingerprints. Our proposed 
approach would allow States to deny 
enrollment to newly enrolling providers 
and to terminate existing providers if 
the provider or if individuals who have 
an ownership or control interest in the 
provider or who are agents or managing 
employees of the provider refuse to 
submit fingerprints when requested to 
do so, We solicited comments on this 
proposal including its appropriateness 
and utility as a fraud prevention tool. 

In addition, we solicited comment on 
the applicability and appropriateness of 
using, in addition to or in lieu of 
fingerprinting, other enhanced 
identification techniques and secure 
forms of identifmation including but not 
limited to passports. United States 
Military identihcation, or Real ID 
drivers licenses. As technology and 
secure Identification techniques change, 
the tools we or State Medicaid agencies 
use may change to reflect changes in 
technology or in risk identification. We 
solicited comment on the appropriate 
uses of these techniques and the ways 
in which we should notify the public 
about any tools CMS or State Medicaid 
agencies would adopt. We also 
welcomed comments on whether there 
should be differences allowed between 
Federal and State techniques, or among 
States, and if so, on what basis. 

As stated previously, pursuant to 
section 2107(e)(1) of the Act, all 
provisions that apply to Medicaid under 
sections 1902(a)(77) and 1902(kk) of the 
Act apply to CHIP. Because wo 
proposed a new regulation in Part 457 
under which all provider screening 
requirements that apply to Medicaid 
providers will apply to providers that 
participate in CHIP, these requirements 
for criminal background checks and 


fingerprinting under § 455.434 will 
apply in CHIP. 

Comment: A number of commenters 
noted the undue and signiflcant burden 
on the States and providers that the 
criminal background check requirement 
in § 455.434. and specifically the 
fingerprint requirement, would pose. 
These commenters noted that State 
Medicaid agencies do not have the staff 
or expertise to conduct the checks. One 
commenter stated that enforcement of 
this provision will have deleterious 
effects on the Medicaid provider 
network and act as a barrier to care, and 
recommended removing the 
fingerprinting and bacl^ound check 
requirements for high risk providers. 

Other commenters were supportive of 
the proposal to conduct criminal 
background checks and collection of 
fingerprints, noting that the proposal 
was intended to screen out 
unscrupulous providers. One 
commenter recognized that the proposal 
to add fingerprinting ofhigh risk 
entities was a way to evaluate the 
background of potential providers, to 
identify fraud and prevent individuals 
with known criminal backgrounds from 
participating in Medicaid. 

Other commenters were concerned 
about the relative cost and efficiency of 
conducting the criminal background 
checks. Several commenters suggested 
that the background checks be at the 
States’ discretion. One commenter 
suggested that CMS conduct any 
necessary fingerprinting, regardless of 
whether the person or entity is enrolled 
in Medicare. Another commenter 
recommended that CMS consider 
limiting FBI criminal background 
checks to cases in which there is 
reasonable cause to believe the subject 
may have a criminal record in another 
State. 

Response: We have considered all the 
comments received and are sensitive to 
the burden the criminal background 
checks and fingerprinting will pose to 
the State Medicaid agencies and the 
affected providers. However, we believe 
that criminal background checks are an 
effective means of evaluating a high risk 
provider. Furthermore, we believe that 
fingerprinting high risk providers and 
their owners are worthwhile endeavors 
to determine identity and whether the 
provider and other individuals have 
been involved in criminal activities that 
would adversely impact the Medicaid 
program. While we are finalizing the 
requirement to conduct criminal 
background checks and collect 
fingerprints for high risk providers, the 
requirement will be limited to providers 
and persons with a five percent or more 
direct or indirect ownership interest in 


the provider. There will be no 
requirement to conduct criminal 
background checks on, or collect the 
fingerprints of. persons with a control 
interest in the provider or the agents or 
managing employees ofhigh risk 
providers. However, we intend to 
monitor the situation and may seek to 
extend the scope of fingerprint-based 
criminal background checks in the 
future if circumstances warrant. We are 
making the appropriate changes to 
§ 455.434. States will not be required to 
implement criminal background checks 
and fingerprinting until we issue 
additional guidance. To the extent that 
States have the ability to conduct 
background checks and collect 
fingerprints at this time, it is within 
their discretion to do so prior to the 
delayed implementation date, States 
have the discretion to impose more 
stringent requirements for Medicaid- 
only and CHIP-only providers than 
those we are requiring. 

Comment One commenter asked how 
results of criminal background checks 
would be communicated in data 
available to States from CMS. 

Response: We are currently examining 
to what extent we can support a 
centralized information sharing solution 
for provider screening results across 
programs and across States. The 
individual results of a criminal 
background checks performed, however, 
would likely be sent directly to the 
agency requesting the background check 
from Ae entity that performed the 
check. 

Comment; One commenter asked 
whether there would be standard 
criteria that define the types of 
convictions that warrant denial of a 
provider’s application. 

Response: Whether to deny 
enrollment or to terminate enrollment 
are decisions that are within the 
discretion of each State Medicaid 
agency in accord with §455.416. Thus, 
the types of convictions that warrant 
denial of enrollment would be at the 
discretion of the State Medicaid agency. 

Comment: Some commenters asked 
what level of background check was 
required, for example, were State 
Medicaid agencies expected to do a 
Federal criminal background check or a 
State criminal background check. 

Response: While it is within the State 
Medicaid agency’s discretion to decide 
whether to conduct State or Federal 
background checks for Medicaid-only 
providers, we recommend that the State 
conduct Federal criminal background 
checks which would provide 
information that is national in scope 
and therefore would be more complete. 
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Comment: A few commenters 
questioned which databases a States 
should consult to compare fingerprints 
against in order to do the screening 
under this provision, in the event that 
law enforcement is not available to 
review the fingerprints? 

Response: We are not aware of 
databases that the Stale Medicaid 
agencies might search, however, there 
are vendors that provide the service for 
a fee. 

Comment: One commenter questioned 
whether the State Medicaid agency must 
perform a criminal background check in 
its State only or, in the neighboring State 
for a provider applicant that only 
provides services in the neighboring 
State. 

Response: The States have the 
discretion to decide, however, we 
would recommend conducting a FBI 
criminal history record check, which 
would provide information that is 
national in scope and therefore would 
be more complete and would be 
preferable to a State background check 
in either the enrolling State or the 
neighboring State. 

Comment: Some commenters noted 
that fingerprints created a logistical 
concern for the State Medicaid agencies. 
Once they have obtained the fingerprint 
cards from the providers, should the 
States maintain the files, how should 
they maintain the cards, and for how 
long? If electronic files, how should the 
States maintain those files? 

Response; The State Medicaid 
agencies should follow their existing 
records retention laws and procedures, 
however we recommend that the State 
Medicaid agencies retain the files for at 
least 5 years, until the provider's 
revalidation. To the extent that a State 
Medicaid agency itself receives the 
fingerprints submitted, we expect them 
to maintain those files in a secure 
manner to protect the privacy of the 
individual who submitted the 
fingerprints. 

Comment; One commenter suggested 
that the provision be revised so that it 
does not require two copies of the 
fingerprint card but allows for collection 
of two copies if the State determines 
that two copies are needed. 

Response; We agree, and are making 
that change. to § 455,434. 

B. Deactivation and Reactivation of 
Provider Enrollment — Medicaid and 
CHIP 

Section 1902(kkKl) of the Act 
requires the screening of Medicaid 
providers to ensure they are eligible to 
provide services and receive payments, 
in an effort to further protect the 
Medicaid program and to be consistent 


with longstanding Medicare 
requirements, we proposed in §455.416 
that any Medicaid provider that has not 
submitted any claims or made a referral 
that resulted in a Medicaid claim for a 
period of 12 consecutive months must 
have its Medicaid provider enrollment 
deactivated. Further, under § 4SS.420, 
we proposed that any such provider 
wishing to be reinstated to the Medicaid 
program must first undergo all 
disclosures and screening required of 
any other applicant. In addition, we 
proposed that the provider must pay 
any associated application fees under 
§455,426. 

As stated previously, pursuant to 
section 2107(eKl) of the Act, all 
provisions that apply to Medicaid under 
sections 1902(a){77)and 1902(kk) of the 
Act apply to CHIP. Because we 
proposed a new regulation in Part 457 
under which all provider screening 
requirements that apply to Medicaid 
providers will apply to providers that 
participate in CHIP, the proposed 
requirements for deactivation and 
reactivation of provider enrollment 
under § 455.418 and § 455.420 would 
apply in CHIP. 

Comment; A few commenters 
supported the proposed requirement as 
written. A number of commenters were 
supportive of the spirit of this proposed 
requirement but suggested that we 
lengthen the timeframe to 24 months. 
Other commenters expressed concern 
regarding the applicability of the 
application fee when reactivating 
enrollment and suggested that Medicaid 
follow a streamlined reactivation 
process similar to what occurs in the 
Medicare program. 

One State commenter expressed 
concern that the requirement to 
deactivate providers would necessitate 
deactivating one third of the State's 
enrolled providers. Other State 
commenters noted that out-of-State 
providers would routinely be 
deactivated because their billings are so 
infrequent. 

Response: We recognize that many 
out-of-State providers provide 
occasional emergency treatment to 
Medicaid beneficiaries, and that 
requiring States to deactivate those 
providers after a year without billings 
would cause administrative burdens for 
the States and the providers. We believe 
States should have the discretion to 
police their own provider enrollment, 
although we recommend that States 
deactivate provider numbers that have 
not been used for an extended period of 
time. 

After reviewing the comments 
received and other operational 
considerations we are not finalizing the 


requirement for deactivation of provider 
numbers after 12 months in § 455.418 at 
this time. 

f. Enrollment and NPI of Ordering or 
Referring Providers — Medicaid and 
CHIP 

Section 1962{kk){7) of the Act 
provides that States must require all 
ordering or referring physicians or other 
professionals to be enrolled under a 
Medicaid State plan or waiver of the 
plan as a participating provider. 

Further, the NPI of such ordering or 
referring provider or other professional 
must be on any Medicaid claim for 
payment based on an order or referral 
from that physician or other 
professional. 

Providers and suppliers under 
Medicare and providers in the Medicaid 
program are already subject to the 
requirement that the NPI be on 
applications to enroll and on all claims 
for payment, pursuant to section 6402(a) 
of the ACA, amending section 1128f of 
the Act, and under § 424.506, § 424.507, 
and § 431-107, as amended by the May 
5. 2010 interim final rule with comment 
period (75 FR 24437). 

In §455,410, we proposed that any 
physician or other professional ordering 
or referring services for Medicaid 
beneficiaries must be enrolled as a 
participating provider by the State in 
the Medicaid program. We proposed 
that this would apply equally to fee for 
service providers or MCE network-level 
providers, 

Additionally, we proposed to amend 
§438.6 to require that States must 
include in their contracts with MCEs a 
requirement that all ordering and 
referring network-level MCE providers 
be enrolled in the Medicaid program, as 
are fee for service providers, and thus 
are screened directly by the State. 

Although the NPI requirements in 
section 6402(a) of the ACA did not 
extend to CHIP providers, section 6401 
of the ACA does apply equally to CHIP, 
and the proposed requirement for 
ordering and referring physicians or 
other professionals under the Medicaid 
program apply equally under CHIP, 

In addition, in § 455.440. we proposed 
that ail claims for payment for services 
ordered or referred by such a physician 
or other professional must include the 
NPI of the ordering or referring 
physician or other professional. We 
proposed that this would apply equally 
to fee for service providers or MCE 
network -level providers. 

It is essential that ail such claims have 
the ordering or referring NPI and that 
the State has properly screened the 
ordering or referring physician or other 
professional. Without such assurances. 
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it is difficult for CMS or the State to 
determine the validity of individual 
claims for payment or to conduct 
effective data mining to identify 
patterns of fraud, waste, and abuse. 

As stated previously, pursuant to 
section 2107(eKl) of the Act, all 
provisions that apply to Medicaid under 
sections 1902(a)(77l and 1902{kk) of the 
Act apply to CHIP, Because we 
proposed a new regulation in Part 457 
under which all provider screening 
requirements that apply to Medicaid 
providers will apply to providers that 
participate in CHIP, these requirements 
for provider enrollment and NPI under 
§ 455.410 and § 455.440 apply in CHIP, 

Comment: Many commenters 
expressed concern regarding whether 
the ordering and referring requirements 
in the proposed rule applied in the 
managed care environment. Many State, 
MCO, and association commenters also 
expressed concern regarding the impact 
that mandatory enrollment under 
§ 455,410 would have upon Medicaid 
beneficiary access to providers. These 
commenters stated concerns about the 
ability to contract with providers and 
other professionals if there was a 
requirement for those providers to be 
enrolled with the State as participating 
providers. The MCO and association 
commenters also cited their concerns 
about network level providers wanting 
to control their practices and not being 
mandated to participate in the Medicaid 
program when their preference was to 
serve in a Medicaid MCO. In addition, 
a State commenter expressed the 
concern that they be able to attract 
MCOs to their programs to provide 
choice to beneficiaries. 

Several State commenters also noted 
that adding managed care ordering and 
referring providers to their rolls in 
addition to the proposed requirement 
for re-enrollment every 5 years, as well 
as the other proposed screening 
requirements would impose 
administrative and fiscal burden on 
State resources. 

A few association commenters 
suggested that States implement a 
registration process whereby MCO 
network level providers would engage 
in a process short of full exuollment 
witli the Medicaid agency, solely for the 
purpose of screening. Several 
commenters also expressed concerned 
related to: (1) Consistency of screening 
across Medicare and Medicaid, and 
across the MAOs and Medicaid 
managed care; and (2) who would 
conduct the screening, There was some 
confusion about whether the MAOs and 
MCOs would conduct the screening of 
the network level providers, or whether 
Medicare contractors and State 


Medicaid agencies would conduct the 
screening. There was also the issue of 
MAO providers not being specifically 
required to be enrolled to order or refer 
for the items and services they ordered 
or referred for Medicare beneficiaries to 
be paid. 

A few commenters noted the 
adequacy of current credentialing 
performed by Medicaid MCOs and the 
absence of any statement to the contrary 
justifying enrollment of network level 
ordering and referring providers. 

Several State commenters questioned 
how the NPI requirement would apply 
in a managed care environment, when 
risk-based health plans file claims for 
payment for the services of their 
subcontracted network level providers 
based on the contract between the State 
and the risk-based health plan. The 
network level providers ordering or 
referring items or services do not file 
claims for payment as fee-for-service 
providers do. 

Response: After careful consideration 
of the comments we received, as well as 
the statutory language, we have 
determined that the new requirements 
for ordering and referring physicians 
should not apply in a risk based 
managed care context. We do not 
believe it was the intent of the Congress 
to impose stricter requirements on the 
Medicaid program than are imposed in 
Medicare. To require Medicaid managed 
care providers that order or refer items 
or services for Medicaid beneficiaries to 
enroll as Medicaid participating 
providers when MAO providers are not 
also required to enroll in the Medicare 
program to order or refer items or 
services for Medicare beneficiaries 
would be to treat the programs 
unequally. 

In consideration of the concerns for 
beneficiary access and the 
administrative burden that enrollment 
of MCO ordering and referring 
physicians and other professionals 
would impose on State Medicaid 
agencies, and in consideration of the 
parity of requirements for the Medicaid 
and Medicare programs, we are not 
requiring that ordering and referring 
physicians and other professionals in 
managed care risk based health plans 
enroll as participating providers by 
State Medicaid programs. Consequently, 
we are not finalizing the proposed 
change to § 438.6 that would have 
required State managed care contracts to 
require network level providers enroll 
with the Medicaid agency as 
participating providers. 

We are limiting the exemption to risk 
based managed care. Section 1902(kk)(7) 
requires that States must require all 
ordering or referring physicians or other 


professionals to be enrolled under a 
Medicaid State plan or waiver of the 
plan as a participating provider. We 
want to give the greatest effect to the 
statute while creating the least adverse 
impact on beneficiaries. Had we 
extended the exemption to all forms of 
managed care, for example, we would 
have allowed physicians or other 
professionals that participate in primary 
care case management programs that 
operate under State plan waivers to 
avoid enrollment with a State’s 
Medicaid program; or we would have 
allowed home and community based 
services program providers that order or 
refer to avoid enrollment, to the extent 
that a State requires such enrollment. 

We also gave consideration to the 
comments we received regarding access, 
burden on State processes, and 
credentialing. The State and managed 
care organization commenters expressed 
concerns about beneficiary access to 
managed care networks and providers, 
which would be likely to occur in the 
risk-based forms of managed care, but 
not in primary care case management, 
for example. The States also expressed 
concerns about tha burden of enrolling 
as participating providers those 
physicians and other professionals in 
managed care. Again, we interpret their 
concerns to be about risk-based forms of 
managed care, rather than forms of 
managed care in which the provider or 
entity bears no risk, because in the vast 
majority of States network level 
providers in risk-based forms of 
managed care are not enrolled with the 
Medicaid agency. Primary case care 
managers, however, are already enrolled 
with the Medicaid agency as fee-for- 
service providers. In addition, risk- 
based managed care entities conduct 
credentialing required under Federal 
regulations and subject to the terms of 
the contracts between the States and the 
MCOs, PIHPs, or PAHPs. Providers that 
participate in non-risk-based forms of 
managed care are subject to the various 
enrollment requirements that each State 
designate. 

Given ffiat managed care services are 
recorded in encounter claims, we 
recognize that it is not always possible 
for such an ordering or referring 
physician’s or other professional's NPJ 
to be reflected on such a claim. We 
leave it to the State’s discretion, based 
in part on the capability of the State’s 
systems, to require entrance of the NPI 
on the encounter record. 

Comment: A commenter requested 
clarification on whether the requirement 
for ordering and referring physicians or 
other professionals to be enrolled with 
a State Medicaid agency would apply to 
professionals who may not be eligible to 
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enroll in a State's Medicaid program but 
who provide services under the 
supervision of an enrolled provider and 
whose services are billed under the 
provider identification number of that 
eligible Medicaid enrolled provider. 

Response: The requirement for other 
ordering or referring professionals to 
enroll with a State’s Medicaid program 
as a participating provider would 
depend on whether a State’s Medicaid 
program recognized the professional as 
a Medicaid provider. If it did not, there 
would be no requirement to enroll. 

Comment: Several commenters 
expressed concern about the 
applicability of §455-410 and §455.440 
to public sdiool districts. Public schools 
deliver Medicaid school based health 
services to Medicaid eligible children 
and therefore are eiu'olled as Medicaid 
providers. Commenters expressed 
concern about public school-based 
providers, for example, speech language 
therapists, school psychologists, 
occupational therapists, and physical 
therapists, employed by public school 
districts being required to enroll with 
the Medicaid agency as ordering and 
referring physicians or other 
professionals. The commenters noted 
that public school based providers are 
able, but have not been required in the 
past, to get an NPI. Public school 
districts have included their NPI on 
claims and the clinicians are assigned 
unique provider identification numbers 
to facilitate identification of providers 
and services. Therefore, the commenters 
encourage an exemption for public 
school based providers from the NPi 
requirement. 

Response: Public school based 
providers are subject to the ordering and 
referring requirements set forth in 
§ 455.410 and § 455.440. However, as a 
way to minimize the administrative 
burden of enrolling additional 
providers, State Medicaid agencies may 
implement a streamlined enrollment 
process for those providers who only 
order or refer, that is, who do not bill 
for services, similar to the CMS~855~G 
process in the Medicare program. 
Additionally, State Medicaid agencies 
may delegate to State or local 
governmental agencies, such as public 
school districts, the responsibility to 
screen public school based providers 
and to assign unique provider 
identification numbers for claims 
identification. 

Comment: Several commenters noted 
that the regulations at § 455.410 do not 
address whether CMS will provide a 
reliable mechanism or national database 
in which screening results can be 
shared. Without a method to obtain 
results from these other entities. States 


will have to screen all Medicaid 
providers at considerable cost. One 
commenter noted that Medicare and 
CHIP do not define providers the same 
way which will lead to confusion over 
who has been screened through 
Medicare and the sister agencies. 

Response: We are currently examining 
to what extent we can support a 
centralized information sharing solution 
for provider enrollment across programs 
and across States. 

Comment: Several commenters 
responded that the proposed regulation 
would be burdensome on both States 
and providers, requiring providers who 
do not normally work with the 
Medicaid program and new groups of 
providers to enroll. One commenter 
suggested that rather than being 
required to enroll with the Medicaid 
program, providers be permitted to use 
the NPI as evidence of successfut 
Medicare screening and enrollment. 

Response: We are sensitive to the 
additional burden that obtaining an NPI 
will pose, however, inclusion of the NPI 
on all Medicaid claims is a statutory 
requirement. The commenter suggested 
that providers enroll with Medicare and 
use the NPI as evidence of successful 
screening and enrollment. Providers 
should be aware that the NPI is not 
evidence of successful Medicare 
screening and enrollment, but providers 
who are actually enrolled in Medicare 
will not have to be screened again by 
the States to be enrolled in the Medicaid 
programs. The States may implement a 
streamlined enrollment process for 
those providers who only order or refer, 
that is. who do not bill for services, 
similar to the CMS-855-0 proce.ss in 
the Medicare program. 

Comment; One commenter described 
a scenario of a salaried hospital 
physician who was not enrolled by the 
State Medicaid agency, but the hospital 
that employed the physician was an 
enrolled, participating Medicaid 
provider. The commenter questioned 
whether the referral rule applied to the 
physician. 

Response: Yes, the salaried hospital 
physician must enroll with the State 
Medicaid agency to order or refer for 
Medicaid beneficiaries. 

Comment: A commenter sought 
clarification whether the order or 
referral rule applied when an order or 
referral was made prior to the Medicaid 
beneficiary being eligible for Medicaid. 

Response; No, if the order or referral 
was made before the beneficiary was 
Medicaid eligible, then the beneficiary 
may have the order filled or the referral 
fulfilled and the claim for the order or 
referral will be paid. 


Comment: A commenter asked 
whether the ordering and referring rule 
applied to Medicare crossover claims. 

Response: Yes. the beneficiary’s 
claims would be Medicaid claims, 
therefore the provider who ordered or 
referred the Medicaid beneficiary’s 
services would be required to be 
enrolled as a Medicaid participating 
provider. 

Comment: One commenter requested 
clarification on whether CMS will be 
changing claims forms to accommodate 
the coUection of information regarding 
ordering and referring providers. 

Response: To the extent it is necessary 
for the State Medicaid agencies to make 
changes to their claim forms to 
accommodate the new requirement 
regarding ordering and referring 
providers, and then the States should 
make those changes. 

Comment; Several commenters sought 
clarification on whether tlie terms 
“ordering and referring physicians or 
other professionals” included 
prescribing providers. 

Response: We interpret the statutory 
terms “ordering” and “referring” to 
include prescribing (either drugs or 
other covered items) or sending a 
beneficiary’s specimens to a laboratory 
for testing or referring a beneficiary to 
another provider or facility for covered 
services. 

Comment: Some of the commenters 
sought clarification on the definition of 
the term “other professional.” For 
example, does it include rendering 
providers, non-professional providers, 
or providers in waiver programs? 

Response; Under § 455.410(b) and 
section 1902(kk) of the Act, the phrase 
“ordering and referring physicians and 
other professionals” does not include 
rendering providers, as these authorities 
impose a new enrollment requirement 
with respect to physicians and other 
professionals that order or refer items or 
services for Medicaid beneficiaries. 
Other professionals include any person 
or entity recognized to be enrolled by a 
State Medicaid agency, and that may 
order or refer. Of course, to be able to 
submit a claim to a State Medicaid 
agency, for services rendered or items 
supplied to a Medicaid beneficiary, a 
provider must be enrolled as a 
participating provider with that State 
Medicaid agency. 

Comment: One commenter sought 
clarification whether the requirement 
for all ordering and referring physicians 
or other professionals to be enrolled 
with the Medicaid agency as 
participating providers applied to IHS 
providers. 

Response; IHS providers are required 
to comply with § 455.410(b). However, 
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as a way to minimize the administrative 
burden of enrolling additional 
providers. State Medicaid agencies may 
implement a streamlined enrollment 
process for those providers who only 
order or refer, that is who do not bill for 
services, similar to the CMS-855-0 
process in the Medicare program. 

Comment; A commenter questioned 
whether a provider that has enrolled as 
a participating provider to comply with 
§455. 410(b) must submit fee-for-service 
claims to the Medicaid agency, or is the 
provider's status as an enrolled provider 
sufficient for compliance, 

Response: Under §455. 410(b), a 
physician or other professional need not 
submit fee-for-service claims to the State 
Medicaid agency to remain enrolled as 
a Medicaid provider. 

Comment: With respect to § 455.440, 
one State asked whether the provider’s 
NPI must be on each and every claim or 
whether it is sufficient for the provider’s 
NfPI to be on file with the State 
Medicaid agency, and whether the 
prescribing provider’s NPI would be 
required on pharmacy claims. 

Response: Under §455.440. “all 
claims for payment for items and 
services that were ordered or referred” 
must contain the NPI, This is based 
upon the statutory requirement in 
section 1902{kk)(7)(B) of the Act that 
States require the NPI "of any ordering 
and referring physician or other 
professional to be specified on any 
claim for payment that is based upon an 
order or referral of the physician or 
other professional.” Therefore, the 
provider’s NPI must be on every claim, 
including pharmacy claims; it is not 
sufficient tor the provider’s NPI to be on 
file. 

g. Other State Screening — Medicaid and 
CHIP 

Section 1902(kk)(8) of the Act 
establishes that States are not limited in 
their abilities to engage in provider 
screening beyond those required by the 
Secretary, Accordingly, in § 455,452, we 
proposed that States may utilize 
additional screening methods, in 
accordance with their approved State 
plan. 

As stated previously, pursuant to 
section 2107(e)(1) of the Act and 
specified in our regulations in Part 457, 
all provisions that apply to Medicaid 
under sections 1902(a)(77) and 1902(kk) 
of the Act apply to CHIP. Because we 
proposed a new regulation under which 
all provider screening requirements that 
apply to Medicaid providers will apply 
to providers that participate in CHIP, 
this requirement for other State 
screening under § 455,452 applies in 
CHIP. 


h. Final Screening Provisions — 
Medicaid and CHIP 

We are adopting the Medicaid and 
CHIP provider screening requirements 
as proposed with the following 
modifications: 

• We clariHed § 455.104(b}{l} 
regarding the elements of corporate 
addresses. 

• We clarified §455. 104(b)(2) with 
regard to whom the spouse, parent, 
child, or sibling is related. 

• We clarified § 455.104(b)(4) to 
require managing employees to provide 
SSNs and DOBs. 

• We clarified §455. 104(c)(t), and 
§ 455.104(c){l)(i) and (ii) to include 
submission of disclosures from 
disclosing entities as well as providers. 

• We clarified §455.104(c){l)(iii) to 
require submission of disclosures upon 
the request of the Medicaid agency 
during the revalidation of enrollment 
process. 

• We are adopting §455.450 with 
modifications, having clarified that the 
State agency must screen applications 
both in re-enrollment and re-validation 
of enrollment in the introductory 
paragraph; deleted the reference to 
publicly traded companies in 

§ 455.450(a}; deleted reference to 
persons with controlling interests, 
agents and managing employees who 
are required to provide fingerprints in 
§ 455.450(d): and clarified the basis for 
adjusting a screeuing level related to 
moratoria §455.450(e)(2). 

• At §455.414 we clarified that States 
must revalidate the enrollment 
information of all providers at least 
every 5 years. 

« We are adopting §455.416 with 
modifications clarifying terminations of 
persons with 5 percent of more direct or 
indirect ownership interests in the 
provider: and deleting reference to 
persons with controlling interests, 
agents and managing employees under 
bases for termination for failure to 
provide fingerprints. 

• We clarified §455,434 to require 
criminal background checks from 
providers or persons with a five percent 
or more direct or indirect ownership 
interest in the provider who meet the 
State Medicaid agency’s criteria as a 
high risk to the Medicaid program; and 
to require fingerprints from providers 
and person with a five percent or more 
direct or indirect ownership interest in 
the provider, upon the State Medicaid 
agency’s or CMS' request. 

• We are not finalizing the proposed 
provision that States deactivate the 
enrollment of any provider that has not 
billed for 12 months. 

• And finally, we are not finalizing 
the proposed requirement at 


§438.6(c)(5)(vi) that required all 
ordering and referring Medicaid 
Managed Care network providers to be 
enrolled as participating providers 
based on commenters’ concerns 
regarding access to services for 
beneficiaries. 

5, Solicitation of Additional Comments 
Regarding the Implementation of the 
Fingerprinting Requirements 

While this final rule with comment 
period is effective on the date indicated 
herein, we strongly believe that certain 
issues warrant further discussion. 
Accordingly, we will continue to seek 
comment limited to our implementation 
of the fingerprinting provisions 
contained in §424.518 and §455.434 of 
this rule. 

Specifically, we seek comment on 
methods that we can use to ensure the 
privacy and confidentiality of the 
records that will be generated pursuant 
to adopting the criminal history records 
check provisions specified herein. As 
described, we will adopt all protocols 
issued by the FBI. However, we are 
interested in any other privacy concerns 
that interested parties may have in 
addition to thoughts on how best to 
address these concerns. 

In addition, we seek comment on the 
means by which we can measure the 
effectiveness of our adoption of criminal 
history records checks. That is, we are 
seeking comments on tangible, 
measureable methods wo should use to 
demonstrate the effectiveness of these 
provisions. 

In addition, we seek comment on 
whether we should adopt additional 
technology to identify providers and 
suppliers that are enrolling in the 
program. In the proposed rule, we 
solicited specific comments on this 
topic. However, we are interested in 
receiving additional input from 
providers, suppliers, and other 
interested parties in light of the 
provisions set forth in this final rule 
with comment period. 

As noted, we are only seeking 
comment on the limited areas 
previously described. We will accept 
public comment for 60 days following 
publication of this final rule with 
comment period. To reiterate, we are 
finalizing the requirement that 
providers and suppliers will be subject 
to criminal history records checks in the 
event they are considered within the 
“high” level of risk as described in this 
rule. Providers and suppliers, and all 
other commenters, are encouraged to 
submit comments within the 60-day 
window to assist us in best 
implementing the requirements that we 
are finalizing surrounding this 
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technology. We are interested in hearing 
input from all stakeholders, including 
the beneficiary advocacy community, 
law enforcement, providers, and 
suppliers that are subject to the 
requirements set forth in this final rule 
with comment period, and any other 
interested parties. 

B. Application Fee — Medicare, 

Medicaid, and CHIP 
1. Statutory Changes 

Section 6401(a) of the ACA, as 
amended by section 10603 of the ACA, 
amended section 1866(}) of the Act and 
requires the Secretary of DHHS to 
impose a fee on each “institutional 
provider of medical or other items or 
services or supplier.” The fee would be 
used by the Secretary to cover the cost 
of screening and to carry out screening 
and other program integrity efforts, 
including those under section 1866(j) 
and section 1 128J of the Act. Since 
section 10603 of the ACA excludes 
eligible professionals, such as 
physicians and nurse practitioners, from 
paying an enrollment application fee, 
we maintain that an “institutional 
provider” would be any provider or 
supplier that submits a paper Medicare 
enrollment application using the CMS- 
855A, CMS-855B (not including 
physician and non-physician 
practitioner organizations), CMS-855S 
or associated Internet-based PECOS 
enrollment application. 

Section 1866(j)(2)(D)(i) of the Act 
states that the new screening procedures 
implemented pursuant to section 6401 
of the ACA would be applicable to 
newly enrolling providers, suppliers, 
and eligible professionals who are not 
enrolled in Medicare, Medicaid, or CHIP 
by March 25, 2011. Accordingly, the 
enrollment application fees for newly 
enrolling institutional providers and 
suppliers would be applicable on that 
date as well. 

Section 1866(j)(2)(D){ii) of the Act 
states that the new screening procedures 
will apply to currently enrolled 
Medicare, Medicaid, and CHIP 
providers, suppliers, and eligible 
professionals beginning on March 23, 
2012. However, because the new 
procedures are applicable beginning on 
March 25, 201 1 for those providers, 
suppliers, (and eligible professionals) 
currently enrolled in Medicare, 
Medicaid, and CHIP that revalidate their 
enrollment information, we will begin 
collecting the application fee for those 
revalidating entities for all revalidation 
activities beginning after March 25, 

2011 , 

Section 1866(j)(2)(C)(ii) of the Act 
permits the Secretary, acting through 


CMS, to, on a case-by-case basis, exempt 
a provider or supplier from the 
imposition of an application fee if CMS 
determines that the imposition of the 
enrollment application fee virould result 
in a hardship. It also permits the 
Secretary to waive the enrollment 
application fee for Medicaid providers 
for whom the State demonstrates that 
imposition of the fee would impede 
Medicaid beneftciaries’ access to care. 

Section 18^(})(2)(CKi)(lj of the Act 
establishes a $500 application fee for 
providers and suppliers in 2010. For 
2011 and each subsequent year, the 
amount of the fee would be the amount 
for the preceding year, adjusted by the 
percentage change in the consumer 
price index for all urban consumers (all 
Items; United States city average), (CPI- 
U) for the 12-monlh period ending with 
June of the previous year. To ease the 
administration of the fee, if the 
adjustment sets the fee at an uneven 
dollar amount, we will round the fee to 
the nearest whole dollar amount. 

2. Proposed Application Fee Provisions 

In §424.502, we also proposed to 
establish a definition for an 
“institutional provider” as it relates to 
the submission of an application fee. We 
proposed that an “institutional 
provider” means any provider or 
supplier that submits a paper Medicare 
enrollment application using the CMS- 
855A. CMS-855B (but not physician 
and nonphysician practitioner 
organizations), or CMS-855S or 
associated Internet-based PECOS 
enrollment application. 

For purposes of Medicare, Medicaid, 
and CHIP, we interpret the statutory 
reference to “institutional providerfsj of 
medical or other items or services or 
supplier” to include, but not be limited 
to: The range of ambulance service 
suppliers: ASCs; CMHCs; CORFs: 
DMEPOS suppliers; ESRD facilities; 
FQHCs; histocompatibility laboratories; 
HHAs; hospices; hospitals, including 
but not limited to acute inpatient 
facilities, inpatient psychiatric facilities 
(IPFs), inpatient rehabilitation facilities 
(IRFs), and physician-owned specialty 
hospitals; CAHs; independent clinical 
laboratories; IDTFs; mammography 
centers; mass immunizers (roster 
billers); OPOs; outpatient physical 
therapy/occupational therapy/speech 
pathology services, portable x-ray 
suppliers; SNFs; radiation therapy 
centers: RNHCIs; and RHCs. 

In addition to the providers and 
suppliers listed previously, for purposes 
of Medicaid and CHIP, we proposed that 
a State may impose the application fee 
on any institutional entity that bills the 
State Medicaid program or CHIP on a 


fee-for-service basis, such as: Personal 
care agencies, non-emergency 
transportation providers, and residential 
treatment centers, in accordance with 
the approved Medicaid or CHIP State 
plan. 

We proposed that an application fee 
will not be required from an eligible 
professional who reassigns Medicare 
benefits to another individual or 
organization, since it would not create 
a new enrollment of an institutional 
provider or supplier that would result in 
an application fee. in addition, we 
proposed that in no case would the 
application fee be required from any 
individual physician or Part B medical 
group/clinjc. 

We proposed that an application fee 
will be required with the submission of 
an initial enrollment application, the 
application to establish a new practice 
location, as a part of revaiidation. or in 
response to a CMS revaiidation request. 

We proposed that prospective 
institutional providers and suppliers as 
well as currently enrolled providers 
who are revalidating their enrollment in 
Medicare must submit the applicable 
application fee or submit a request for 
a hardship exception to the application 
fee at the time of filing a Medicare 
enrollment application on or after 
March 25, 2011 in the case of 
prospective providers or suppliers, and 
in the case of revalidations. We believe 
that it is essential that we are able to 
receive and deposit the application fee 
or consider the institutional provider's 
request for a hardship exception prior to 
initiating an application review. 
Therefore, we would not begin 
processing an application for either a 
new provider or supplier, or for a 
provider or supplier that is currently 
enrolled, until the enrollment 
application fee is received and is 
credited to the United States Treasury. 

The fee would accompany the 
certification statement that the provider 
or supplier signs, dates, and mails to 
CMS via the appropriate Medicare 
contractor if the provider or supplier 
uses Internet-based PECOS to enroll or 
revalidate. The fee would accompany 
the paper CMS-855 provider enrollment 
application if the provider or supplier 
enrolls or revalidates by paper. Because 
the statutory provisions are effective for 
newly enrolling providers and suppliers 
effective March 25, 2011 institutional 
providers and suppliers will not be 
required to furnish the application fee 
with applications submitted before that 
date. However, because the ACA 
provides that the new procedures will 
be applicable beginning on March 25. 
2011 for those providers and suppliers, 
(and eligible professionals) currently 


228 


5908 Federal Register/ Vol. 76, No. 22/ Wednesday, February 2, 2011 /Rules and Regulations 


enrolled in Medicare, Medicaid, and 
CHIP that revalidate their enrollment 
information, we will begin collecting 
the application fee for those revalidating 
entities for all revalidation activities 
beginning after March 25, 2011. We will 
not collect the fee from individual 
physicians and eligible professionals, 

We proposed that CMS reject and 
return to the provider or supplier an 
initial enrollment application submitted 
by a provider or supplier, without 
further review as to whether the 
provider or supplier qualifies to enroll 
in the Medicare program, when the 
Medicare enrollment application or the 
Certification Statement is received by 
the Medicare contractor and the 
provider or supplier did not include a 
request for hardship exception to the 
application fee, did not include the 
application fee or the appropriate 
number of application fees, if 
applicable. We do not believe that it is 
appropriate for CMS to begin the 
application review process without first 
having received the application fee. 

We proposed that tne CMS reject any 
initial enrollment applications 
submitted after March 23, 2011, if a 
provider or a supplier did not furnish 
the application fee at the lime of filing, 
using § 424.525(a)(3) as the legal basis 
for the rejection. 

In § 424.525(a)(3), we proposed 
adding a new reason why CMS could 
reject an initial enrollment application 
or an application to establish a new 
practice location. Specifically, we 
proposed a new § 424.S25(a)(3) to state, 
“The prospective institutional provider 
or supplier does not submit an 
application fee in the appropriate 
amount or a hardship exception request 
with the Medicare enrollment 
application at the time of filing.” 

We also believe CMS should be 
allowed to reject an initial enrollment 
application received from a provider or 
supplier on or after March 25, 2011, 
using §424.525(aKl) as the legal basis, 
if, for any reason, CMS is not able to 
deposit the full application amount Into 
a government-owned account or the 
funds are not able to be credited to the 
U.S, Treasury. In the case where a 
provider or supplier did not submit the 
application fee because they requested a 
hardship exception that is not granted, 
a provider or supplier has 30 days from 
the date on which the contractor sends 
notice of the rejection of the hardship 
exception request to send in the 
required application fee and application 
forms. 

In § 424.535, we proposed adding a 
new reason why a CMS can revoke 
Medicare billing privileges. Specifically, 
we proposed a new § 424.535(a)(6)(i) to 


state that billing privileges may he 
revoked if “An institutional provider 
does not submit an application fee or 
hardship exception request that meets 
the requirements set forth in § 424.514 
with the Medicare revalidation 
application or the hardship exception is 
not granted.” 

In addition, in § 424.535, we proposed 
a new § 424.S35{a)(6){ii) to state that 
billing privileges shall be revoked if 
“CMS is not able to; deposit the full 
application amount into a government- 
owned account or the funds are not able 
to be credited to the U.S. Treasury.” 

In § 424.514(b}, we proposed that 
currently enrolled institutional 
providers and suppliers that are subject 
to CMS revalidation efforts must submit 
the applicable application fee or submit 
a request for a hardship exception to the 
application fee at the time of filing a 
Medicare enrollment application on or 
after March 23. 2011. 

In §424.514(d){2}(iii}, we proposed 
that institutional providers submit the 
application fee with each initial 
application, application to establish a 
new practice location, or with the 
submission of an application in 
response to a CMS revalidation request. 

In § 424.514(d)(2). we proposed that 
the application fee be based on the 
amount calculated by CMS using the 
CPI-U for the 12-month period ending 
June 30 of the previous year and 
adjusted annually to be effective January 
1st of the following year. In 
§ 424.514(d)(2)(v). we proposed that the 
application fee be non-refundable. 
Neither the Federal government, its 
Medicare contractors, State Medicaid 
agencies or CHIP should be liable for 
reimbursement of the application fee to 
the provider or supplier if the 
application fee has been received by the 
Medicare contractor and deposited into 
a government-owned account and, later, 
during the course of verifying, 
validating, and processing the 
information in the enrollment 
application. CMS appropriately denies 
the enrollment application. Appropriate 
denial requires a substantive reason and 
applications wilt not be denied over 
inconsequential errors or omissions or 
over errors or omissions corrected 
timely. 

In §424.514(d)(4)(vi), we proposed 
that a provider or supplier must submit 
a new application fee if the provider or 
supplier resubmits a Medicare 
enrollment application because a 
previously submitted enrollment 
application was appropriately denied or 
rejected. In some cases, a rejected 
application would be returned to the 
provider or supplier along with the 
application fee; in other cases, the 


application would be denied and the 
application fee retained by the Federal 
government because the processing of 
the application would have already 
begun. In those latter cases. CMS funds 
would have been expended for some or 
all of the required screening involved in 
processing the application. For example, 
if a home health agency enrollment 
application is rejected because the 
enrollment application, or the 
certification statement generated by 
Internet-based PECOS, was not signed, 
the enrollment application would be 
rejected and it and the check for the 
application fee would both be returned 
to the home health agency. If a home 
health agency enrollment application is 
denied based on non-compliance with a 
provider enrollment requirement or 
because the HHA did not meet the 
conditions of participation for Its 
provider type, the enrollment would be 
denied and the application fee would be 
retained by the Federal government. If 
the HHA wishes to send a new 
enrollment application, it would have to 
include another application fee with 
that new enrollment application. 
Similarly, we propose that a provider or 
supplier would be required to submit to 
the Medicare contractor a new 
application fee with a subsequent 
enrollment application if, among other 
things, the previous enrollment 
application was rejected because the 
provider or supplier did not timely 
furnish the Medicare contractor with the 
applicable supporting documentation or 
information necessary to complete its 
review and verification of the previous 
enrollment application. 

In § 424,514(d)(6)(vii), we proposed 
that the application fee must be able to 
be deposited into a government-owned 
account before an enrollment 
application will be approved. 

Because we proposed that a State may 
rely on the results of the screening 
conducted by the Medicare contractor to 
meet the screening requirements for 
participation in a State Medicaid 
program or CHIP, we proposed that, for 
dually participating providers, the 
application fee would be imposed at the 
time of the Medicare enrollment 
application, consistent with the 
procedures described previously. 
Additionally, because the purpose of the 
application fee is to, in part, cover the 
costs of conducting the provider and 
supplier screening activities, we 
proposed that a provider or supplier 
enrolled in more than one program (that 
is. Medicare and Medicaid or CHIP, or 
all three programs) would only he 
subject to the application fee under 
Medicare and that the fee would cover 
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screening activities for enrollment in all 
programs. 

Section 1866(j)(2)(C){iii) of the Act 
also permits the Secretary to grant, on 
a case-by-case basis, exceptions to the 
application Fee For institutional 
providers and suppliers enrolled in the 
Medicare and Medicaid programs and 
CHIP if the Secretary determines that 
imposition of the fee would result in a 
hardship. One instance that might 
support a request for hardship exception 
is in the event of a national public 
health emergency where a provider or 
supplier is enrolling for purposes of 
furnishing services required as a result 
of the national public health emergency 
situation, Such requests will be 
considered on a case-by-case basis, as 
required by the statute. In addition, we 
solicited comments on the appropriate 
objective criteria that should be used in 
making a hardship determination and if 
thera are any other circumstances in 
which such exemptions should be 
allowed. We also solicited comment on 
the kinds of documents to be submitted 
to CMS or its contractor to exhibit 
hardship, including any comments on 
the financial or legal records that might 
be needed to make a determination of 
hardship. Section 1 866(j)(2)(C)(iii) of the 
Act also permits the Secretary to waive 
the application fee for providers 
enrolled in a State Medicaid program for 
whom the State demonstrates that 
imposition of Qie fee would impede 
beneficiary access to care. We solicited 
comments on how waivers from the 
application fee should be implemented 
for Medicaid-only or dually- 
participating Medicare and Medicaid 
providers and suppliers specifically 
those seeking to mrnish services where 
beneficiary access issues are prevalent, 
either geographically or in the provision 
of the services. 

We are committed to assuring access 
to care for program beneficiaries. We are 
in the process of developing promising 
practices related to ensuring access in 
the Medicaid program and CHIP. We 
also solicited comments on the 
appropriate criteria that we should 
consider for purposes of the proposed 
fee. We were particularly interested in 
hearing from States, providers, 
advocates, and other stakeholders 
relating to concrete examples based cn 
experiences in using specific access 
criteria. 

Based on the statutory requirements 
for calculating the application fee, we 
offer the following example for purely 
illustrative purposes. The initial 
application fee beginning in 2010 is 
established by law at $500, However, for 
the following year, when the annual 
Consumer Price index (CPI-U) is 


calculated for the period endii^ )une 

2010, we would recalculate the 
application fee using the CPI-U. Thus, 
if the CPI increased by 2.34 percent for 
the 12 month period ending June 2010, 
the application fee would be calculated 
by multiplying the fee for the year by 
the CPl-U. The $500 application fee 
established by law on in 2010 would be 
multiplied by 1.0234 to give $511.70. 

We would then round to the nearest 
dollar amount of $512.00. This would 
be the amount of the fee in effect for 

2011 , and would apply to applications 
received after the effective date of the 
statute — March 25, 2011 for newly 
enrolling providers and suppliers and 
for revalidating providers and suppliers, 
A similar process, based on the CPI-U 
for the period of July 1, 2010 through 
June 30, 2011 would be used to 
calculate the fee that would become 
effective on January 1, 2012, and that 
would apply to new and currently 
enrolled providers or suppliers that 
submit applications on or after March 
23. 2012. In §424. 514(d)(2). we 
proposed that the annually recalculated 
application fee amount would be 
effective for the calendar year during 
which the application for enrollment is 
being submitted. 

The amount of the application fee that 
is required of enrolling providers or 
suppliers, would be the amount that Is 
in effect on the day the provider or 
supplier mails an enrollment 
application or Certification Statement, 
postmarked by the USPS, or if mailed 
though a private mail service the date of 
receipt by the Medicare contractor. 
Because the application fee will become 
an integral part of the enrollment 
process, we believe that it is essential 
that we notify State Medicaid Agencies 
and the public about any changes in the 
application fee prior to implementing a 
change in the fee. Accordingly, we 
would afford States and the public with 
at least 30 days’ notice of any 
impending change in the application 
fee. We will make such notification 
annually in the Federal Register and by 
issuing guidance to the State Medicaid 
and CHIP Directors, issuing CMS 
provider and supplier listserv messages, 
making announcements at CMS Open 
Door Forums, and placing information 
on the CMS Provider/Supplier 
Enrollment Web page {http:// 
www.cms-gov/ 

MedicareProviderSupEnrolll. 

We proposed that a provider or 
supplier that believes it is entitled to a 
hardship exception horn the application 
fee enclose a letter with the enrollment 
application or, if using Internet-based 
PECOS, with the Certification 
Statement, explaining the nature of the 


hardship. Further, we proposed that we 
would not begin to process an 
enrollment application submitted with a 
letter requesting a hardship exception 
from the application fee until it makes 
a decision on whether to grant the 
exception. Further, we proposed that we 
a make hardship exception 
determination within 60 days from 
receipt of the request from an 
institutional provider and CMS 
contractor notify the applicant or 
enrolled institutional provider or 
supplier by letter approving or denying 
the request for a hardship exception, 
Moreover, if we deny the request for 
hardship exception, we would provide 
our reason(s) for denying the hardship 
exception. 

In § 424.530(a)(9). we proposed 
adding a new reason why CMS can deny 
Medicare billing privileges, Specifically, 
we proposed a new § 424.530(aK9) to 
state, “An institutional provider’s or 
suppliers “hardship exception” request 
is not granted and the provider or 
supplier does not submit the application 
fee within 30 days of notification that 
the hardship exception request was not 
approved.” 

In § 424.535{a)(6)(i), we proposed 
adding a new reason why CMS can 
revoke Medicare billing privileges. 
Specifically, we proposed a new 
§4 24.535{a)(6)(i) to state. “An 
institutional provider does not submit 
an application fee or “hardship 
exception” request that meets the 
requirements set forth in §424.514 with 
the Medicare revalidation application or 
the hardship exception request is not 
granted and the institutional provider 
does not submit the applicable 
application form or the application fee 
within 30 days of being notified that tho 
hardship exception request was denied.” 

We also proposed that an institutional 
provider may appeal the determination 
not to grant a hardship exception from 
the application fee using the provider 
enrolment appeals process established 
in §405.874 and found in 1866(j){2) of 
the Act. 

In §455.460, we proposed that, for 
those providers who do not participate 
in Medicare, the State may collect the 
fee established by the Secretary as 
outlined previously as the State will be 
responsible for conducting the provider 
screening activities for these providers. 
Total fees collected will be used to 
offset the cost of the Medicaid and CHIP 
screening programs. The fees represent 
an applicable credit under 0MB 
Circular A-87. entitled “Cost Principles 
for State, Local, and Indian Tribal 
Governments” (August 31, 2005 (70 FR 
51910)), codified at 2 CFR part 225, and 
made applicable to States by 45 CFR 
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92, 22(b). The cost principles require 
that the costs a State claims must be 
reduced by “applicable credits,” or 
“those receipts or reduction of 
expenditure-type transactions that offset 
or reduce expense items allocable to 
Federal awards as direct or indirect 
costs”, (Paragraphs C.l.i., C.4.a. and D.l, 
of Appendix A to 2 CFR part 225). If the 
fees collected by a State agency exceed 
the cost of the screening program, the 
State agency must return that portion of 
the fees to the Federal government. CMS 
will direct these fees to support program 
integrity efforts as permitted by the 
ACA, 

3. Analysis of and Responses to Public 
Comments 

Below is a summary of the comments 
we received regarding the proposed 
enrollment application fee. 

Co/n/nenf: Through section 6401 of 
the ACA, CMS is authorized to collect 
and retain an application fee. Some 
commenters stated that CMS did not 
explain or justify the purpose behind 
the enrollment application fee, for 
enrolled providers of service and 
suppliers, beyond stating that the 
Congress mandated it. The commenters 
urged CMS to explain whether the 
revalidation/enrollment fee is meant to 
ensure compliance with a provider's or 
supplier’s reporting responsibilities or 
to collect monies for the Federal 
Government. 

Response: The ACA authorizes the 
collection of an application fee to cover 
costs of screening, including screening 
required for providers and suppliers 
that are revalidating their enrollment. 
The ACA specifies that the fees are to 
be collected from institutional providers 
and are to be used for program integrity 
efforts, including the costs of screening. 

Comment; Several commenters 
questioned whether CMS has the 
statutory authority to exempt medical 
clinics and group practices from the 
application fee. They contended that 
while section 10603 of the ACA strikes 
the provision found in section 6401 of 
the ACA relating to individual provider 
application fees, section 10603 of the 
ACA does not establish a waiver for 
organizational suppliers, such as groups 
or clinics. They also slated that CMS 
furnished only a limited discussion of 
why it decided to give medical groups 
and clinics an application fee waiver. 
They stated that CMS should explain 
why it is giving medical groups and 
clinics a significant financial benefit by 
excluding them from the application 
fee. Another commenter stated that if 
CMS retains its policy to exempt 
medical groups and clinics from the 
application fee, CMS should estimate 


the annual loss in revenue to the 
Federal government and explain what 
this will mean to CMS’ efforts to fight 
fraud, waste and abuse. Another 
commenter stated that if CMS retains 
this provision, it should exclude the 
reference to physician and non- 
physician practitioner organizations in 
the proposed definition of institutional 
provider. 

Response: Section 6401(a) of the ACA 
that adds section 1866(j)(2} of the Act 
specifically excluded physicians fiom 
paying the application Fee. Physicians 
and non-physician practitioners in 
medical groups and clinics reassign 
their Medicare billing privileges to those 
medical group and clinics. As such they 
would be exempt from the fees. 

Comment: One commenter asked if a 
small group practice would be 
considered institutional, and whether 
every practice location would need to 
submit a separate application fee. 

Response: We will clarify that the 
application fee is not applicable to 
physicians and non-physician 
practitioners, regardless if the physician 
or non-physician practitioner is 
organized in a small group practice. 

Comment; A commenter urged CMS 
to consider exceptions to the required 
application fee, which, the commenter 
stated, could impose a hardship on 
small home and community based 
service providers. 

Response: We are committed to 
ensuring access to care and services for 
beneficiaries and will clarify that a 
State, in consultation with Ute 
Secretary, may waive the application fee 
for Medicaid-only orCHlP-only 
providers if the State demonstrates that 
imposition of such a fee will impede 
beneficiary access to care. 

Comment: A commenter suggested 
that CMS develop and issue a standard 
enrollment fee “hardship exception 
form” that a provider can use when 
requesting an exception to the fee. 

Response; Whereas a standard form 
might be useful, there could be many 
situations that justify exception from the 
fee. We do not want to limit the basis 
for fee exceptions for providers and 
suppliers to a pre-established list of 
circumstances. Accordingly we have not 
listed options for providers and 
suppliers to request hardship exceptions 
from application fees. As indicated in 
the preamble to the proposed rule, each 
request will be considered on its own 
merit on a case-by-case basis. 

Comment: A commenter suggested 
that to avoid processing delays 
associated with depositing the 
application fee into a government- 
owned account, CMS should allow 
newly-enrolling Medicare, Medicaid 


and CHIP providers to submit the 
application fee in advance of submitting 
a new enrollment application. 

Response: We disagree with the 
commenter’s suggestion. We think 
payments should be clearly associated 
with the CMS-855 application form. We 
believe that payments submitted before 
the CMS-855 could have a greater 
likelihood of being disassociated with 
the appropriate CMS-a55. 

Comment: One commenter stated that 
since the application fee must be 
credited to the United States Treasury, 
CMS should explain how long it will 
take before the application fee is paid by 
a provider or supplier and when CMS 
will receive this money to fight fraud, 
waste and abuse. 

Response; The Treasury Department 
has existing regulations in place 
governing the time frame in which 
received funds must be deposited and 
made available in the U.S. Treasury. We 
will be working with the Office of 
Management and Budget and 
Department of HHS budget officials to 
assure that the full amount collected 
from application fees will accrue to 
CMS for HHS's program integrity work 
as required by section 1866(j)(2)(C)(iii) 
of the Act. 

Comment; A commenter requested 
that CMS explain why an application 
fee is required by a Competitive 
Acquisition Program (CAP) Part B Drug 
Vendor, since this entity does not bill 
the Medicare program, 

Response: Only institutional 
providers, as defined in the proposed 
rule, are subject to the application fee. 
Providers and suppliers that do not bill 
Medicare on a fee-for-service basis are 
not subject to the application fee. 

Comment; A commenter stated that in 
exempting medical groups/clinics from 
the application fee, CMS does not 
distinguish between clinics owned by 
physicians/practitioners and non- 
sicians/non-practitioners. 
esponse; We did not distinguish 
between medical groups/clinics on the 
basis of ownership. Medical groups and 
clinics are exempt from the fee because 
as noted previously, they are paid 
through reassignment of payments from 
physicians and non-physician 
practitioners. Physicians, non-physician 
practitioners and other individual 
practitioners are not subject to the fee by 
statute. 

Comment; A commenter stated that 
FQHCs should be exempted from the 
application fees for two reasons. First, 
FQHCs, unlike other providers, are not 
permitted to submit one Medicare 
enrollment application for all sites, and 
that consequently, these low-risk 
entities would pay the majority of the 
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application fees. Second, a significant 
portion of an FQHC’s budget includes 
section 330 grant funds. These funds are 
primarily intended for the care of 
uninsured and indigent patients. The 
application fees would take a significant 
portion of those funds away from the 
neediest individuals. 

Response; While we understand the 
commenter’s concerns, the statute did 
not exempt FQHCs from the application 
fee requirement. However, FQHCs can 
request a hardship exception to the fee. 

Comment; A commenter 
recommended that CMS update the 
CMS-855A, CMS-855B. and CMS-855S 
forms to add information about the 
application fee, including the basis for 
this fee, the amount of the fee, and 
where the fee should be mailed, 

Response: We agree that providers 
and suppliers need additional 
information about the process for 
submitting the application fee. its basis 
and intended use. We plan to have such 
materials available by the effective date 
of the final regulation. We will make 
these materials available through our 
Web site, listservs, open door forums, 
and other communication methods. We 
will also share these documents with 
professional and provider and supplier 
associations in an effort to provide 
additional information, 

Comment: A commenter noted that 
section 1866(j)(2)(D)(ii) of the Act states 
that the application fee would not apply 
to current providers or suppliers until 
two years after enactment. However, the 
commenter argued, CMS was silent on 
this statutory provision in the proposed 
rule. The commenter recommended that 
CMS explain why section 
1866(})(2}p)(ii) of the Act does not 
apply to current providers and suppliers 
and why CMS has decided to apply the 
provisions in section 1866(i)(2KD)(iii) of 
the Act instead. 

Response; Section 1 6B6(j)(2)(D} of the 
Act contains conflicting effective dates 
for currently enrolled providers and 
suppliers. In 1866{j){2J{D)(iji), providers 
and suppliers that are revalidating are 
subject to the fee and the other 
provisions of the proposed rule 160 
days after enactment, or September 19, 

2010. In section 1866(i)(2)(D)(ii) of the 
Act the new screening provisions 
including the fee are effective for 
currently enrolled providers and 
suppliers on March 23, 2012. For newly 
enrolling providers and suppliers the 
provisions are effective on March 25, 

2011. We recognize the conflicting 
effective dates for the same group of 
currently enrolled providers and 
suppliers. As a result, in an effort to 
promote consistency in the application 
of the rule, we proposed two effective 


dates for the provisions of the rule for 
currently enrolled providers and 
suppliers. On March 25, 2011, the fees 
and other requirements of the regulation 
are applicable for currently enrolled 
providers that are revalidating their 
enrollment in the period between March 
25. 2011 and March 23. 2012. For all 
other currently enrolled providers and 
suppliers, the fees and other provisions 
of the proposed rule are effective on 
March 23, 2012, as specifted in the 
statute. The statute authorizes us to 
begin collecting fees from providers and 
suppliers that are revalidating as early 
as September 23, 2010, 

Comment: A commenter 
recommended that — consistent with 
section 10603 of the ACA— CMS 
establish an application fee exemption 
for physicians who are sole 
proprietorships or sole owners and who 
provide DMCTOS “incident to” their 
medical service. 

Response: Physicians who are 
enrolled in Medicare as physicians are 
exempt from the fee. DMEPOS 
suppliers, whether owned by physicians 
or otherwise, are institutional suppliers 
and as such, are subject to the 
application fee. 

Comment; Several commenters urged 
an exception from the enrollment fee 
for; (1) Existing providers, or (2) new 
providers in under-served areas. A 
commenter added, however, that such 
exceptions should be limited to 
nonprofit and governmental entities 
with low overall margins. The 
commenter also stated that CMS should 
allow enrollment fee exceptions: (1) For 
existing providers when it is clearly 
equitable and in the public’s interest — 
since to do otherwise simply transfers 
limited resources needed for patient 
care to the enrollment process and 
constitutes a tax on an otherwise 
nontaxable entity — and (2) for any new 
nonprofit or public provider that is 
proposing to establish services in an 
underserved area. The commenter did 
not believe that for-profit providers 
should qualify for fee waivers because 
their business model is based on their 
capacity to generate sufficient capital to 
start a business and operate profitably. 

Response; We recognize that the 
application fees are a new financial 
obligation on nonprofit and public 
providers and suppliers; however, the 
statute provides no blanket exception 
for providers and suppliers by financial 
status. However, the law and rule 
contain provisions that would allow 
institutional providers and suppliers to 
apply for hardship exception to the fees 
for circumstances that are appropriate to 
their respective situations. We 
encourage any provider or supplier that 


cannot pay the fee to notify us and 
provide us with justification for the 
exception. 

Comment: A commenter stated that 
the application fee should be waived for 
providers that routinely update their 
Medicare enrollment information more 
than once in a five-year period (3 years 
for DMEPOS). 

Response; While we do not 
discourage providers and suppliers from 
submitting revalidation applications 
more frequently than the regulatory- 
prescribed timeframes, we do not 
believe that the fee should be waived for 
providers that do so. As stated in the 
preamble, the application fee is to be 
used by the Secretary to cover the cost 
of screening. If the provider or supplier 
submits a revalidation application on its 
own volition, we believe it is 
appropriate to require a fee that would 
cover the cost of processing that 
application. 

Commenf; A commenter, expressing 
concern about the time it can take for 
Medicare contractors to process 
applications, recommended that 
payment of the enrollment fee be tied to 
a corresponding obligation of the 
Medicare contractor to complete the 
enrollment process within a specified 
period of time. Specifically, the 
commenter requested that CMS create a 
hardship category that would permit an 
enrollment fee to be refunded to the 
provider or supplier if the Medicare 
contractor fails to process the 
application within a specified period of 
time (for example, 30 days from the date 
a completed enrollment is received by 
the Medicare contractor), The 
commenter stated that such a policy 
would create the proper incentive for 
Medicare contractors to process these 
applications in a timely fashion. Other 
commenters, too, stated that the fee 
should be refunded if the Medicare 
contractor does not process the 
application in a timely manner. 

Response: We are concerned about 
any delay in processing enrollment 
applications. Our enrollment 
contractors have clear standards in their 
contracts regarding processing 
enrollment applications, In fact, we are 
currently in ffie process of strengthening 
such performance standards for all of 
our contractors. However, the ACA 
provides that a provider may be 
exempted from the fee only when the 
imposition of the fee itself would result 
in a hardship. We do not interpret the 
ACA as linking the application fee to 
contractor performance standards. 

Comment: One commenter stated that 
it appears that physicians who also 
enroll as DMEPOS suppliers so they can 
furnish DMEPOS to their own patients 
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would be expected to pay an enrollment 
fee. The commenter believes that this 
would be inconsistent with the 
congressional decision to exempt 
physicians and other health 
professionals from the enrollment fee. It 
might also cause some physicians and 
other health professionals to decide 
against enrolling as DMEPOS suppliers, 
thus they would no longer be in a 
position to provide their patients with 
Medicare-covered DMEPOS. The 
commenter also stated that CMS should 
modify its enrollment procedures so 
that physicians who also wish to 
provide DMEPOS to their own patients 
would only need to enroll once, not 
twice, This approach would simplify 
the enrollment process for both 
physicians and CMS. 

flesponse; Physicians that supply 
DMEPOS services to patients are 
currently required to enroll as both a 
physician {for medical services) and as 
a DMEPOS supplier. The screening 
required of any DMEPOS supplier, even 
one that is incident to a physician’s 
practice, is more resource intensive than 
screening for physicians. Accordingly, 
we think applying the fee to all 
DMEPOS suppliers is justified. 
Moreover, we think it is a necessary 
component of our efforts to assure 
overall benefit integrity in Medicare to 
have all DMEPOS suppliers meet the 
supplier standards for DMEPOS 
suppliers. Accordingly, we have no 
plans to change the requirements as 
suggested by the commenter. We note in 
addition that a decision to make any 
such changes would be outside the 
sc^e of this rule, 

Comment,' A commenter asked why 
CMS is proposing to exempt a physician 
or non-physician practitioner 
organizations from the application fee 
when they submit a CMS-855B 
application, but the same physician or 
non-physician practitioner organization 
would be required to pay an application 
fee if they enrolled using the CMS- 
855S. 

flesponse.'The ACA specifically 
excluded physicians and nonphysician 
practitioners from paying the 
application fee. Physicians or non- 
physician practitioner organizations that 
elect to apply to enroll in Medicare as 
an institution or other entity, for 
example, submitting an CMS-855S to 
enroll as a DMEPOS supplier, are 
applying to enroll as an institutional 
provider not a physician or non- 
physician practitioner. Accordingly, 
applications to enroll as institutional 
providers are subject to submitting the 
application fee. 

Comment; Several commenters stated 
that a $500 application fee for DMEPOS 


suppliers who are orthotists and 
prosthetists is not reasonable, especially 
on top of the required annua! payment 
for a surety bond, accreditation and to 
maintain licensure. One of these 
commenters opposed the proposed rule 
because it seems redundant in light of 
other requirements such as 
accreditation, licensure, non-mandatory 
OIG compliance plans, and HIPAA. The 
commenter stated that with 
reimbursements being cut, expenses 
increasing, and the government 
constantly imposing new, unnecessary 
fees, it is becoming difficult for small 
businesses to survive in this economy. 
Several other commenters stated that 
the fee should be waived for the 
smallest providers. For community 
pharmacies, another commenter urged 
CMS to either: (1) Impose a $500 fee 
upon initial enrollment and in the case 
of the addition of new practice locations 
without imposing any fees for 
revalidation, or (2) impose a lower fee 
of $200 if the fee will apply to 
revalidation, as well as initial 
enrollment and adding new locations. 

Response; The ACA sets the initial fee 
at $500.00 for all types of institutional 
providers or suppliers and for 
revalidating providers. Because the ACA 
specifies that the money be used for 
program integrity activities, including 
screening, we believe it is reasonable 
and appropriate to impose a fee on new 
practice location applications which 
require us to expend resources to screen 
for example onsite visits or background 
checks may be required. Also, the ACA 
specifies the formula for updating the 
fee. Affected providers and suppliers 
can request an exception from the fee if 
they can demonstrate that it poses a 
hardship. 

Comment: A commenter requested 
clarification as to whether a returned, 
rejected, or denied application would 
trigger the need for a provider to resend 
another fee when it resubmits its 
application. The commeuter also asked 
whether a provider going from one state 
to another within Medicare would only 
be required to submit the fee once. 

Response: The proposed rule itemized 
circumstances when additional fees 
would be required. The answer to the 
commenter's question about returned, 
rejected, or denied applications and 
whether these actions would trigger a 
requirement for a new fee will vary 
depending upon the circumstances. 
Providers and suppliers that submitted 
applications that were denied because 
the provider or supplier did not meet 
the requirements to enroll would be 
subject to an additional fee for any new 
application they submit Providers and 
suppliers that submitted an application 


that could not be processed because of 
a temporary moratorium would not be 
required to submit an additional fee, 
Applications that were accompanied by 
a request for hardship exception waiver 
to the fee and for which the hardship 
waiver request was denied would be 
required to submit a fee in order for the 
application to be processed. If, in this 
latter circumstance, the provider or 
supplier submitted the fee with the 
application and the hardship exception 
waiver request, and the fee was not 
returned, the provider or supplier 
would not be required to submit a new 
fee payment. Providers establishing a 
new practice location in a different 
enrollment jurisdiction or as a new 
provider type would be required to 
submit a fee for each new practice 
location or provider type. 

Comment; A commenter stated that 
CMS should allow application fees to be 
held in escrow when an application is 
denied, 

Response; We think it is important for 
the fee to be associated clearly and 
specifically with the application for new 
enrollment or revalidation at the time 
the application for enrollment or 
revalidation is being processed. In this 
way we avoid any administrative errors 
involved in associating a fee held in 
escrow with an instant application. 
There are a number of reasons it might 
be complicated to associate an escrowed 
fee with an application, particularly if 
the provider or supplier has a different 
name or identifier, or a large amount of 
time has elapsed between applying for 
enrollment or revalidation. 

Comment: A commenter believes it 
was inequitable that Institutional 
providers in the limited level of 
screening are still subject to the same 
$500 application fee as providers in the 
high level of screening. The commenter 
recognized that this is a matter of 
statute, but stated that a more equitable 
policy would be to link the application 
fee amount to the assigned level of 
screening, with a zero or minimal fee 
applicable for facilities in the limited 
screening level and higher scaled fees 
applied to the moderate and high 
screening levels. The commenter also 
recommended that CMS use the 
application fee collected from “limited 
risk” providers to develop prioritized 
and expedited processes and timeframes 
for contractor review and approval of 
initial enrollment applications and 
revalidations for “limited risk” 
providers. 

Response; The ACA established a flat 
rate of $500 for application fees to be 
imposed upon institutional providers 
and suppliers, In addition, the ACA 
does not include provisions to link the 
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fee to assigned screening level. 
Accordingly, the proposed rule 
implementing the statute did not link 
the fee to assigned screening level. 

Comment: A commenter stated that 
for DMEPOS suppliers, requiring a $500 
application fee at the time of submission 
of an enrollment application for each 
Medicare PTAN is unsupported and 
improper. A simple $500 fee per 
company, or paying for up to four 
facility locations (but not more) per 
company, or $500 for the first location 
and $50 for the next 1 0 makes sense. A 
flat $500 per location does not make 
sense according to the commenter, since 
clearly larger companies with multiple 
locations pose lower risk. 

Response; As mentioned previously, 
the fee amount is included in the ACA. 
In addition, the ACA requires each 
institutional provider to pay the fee, 
Providers and suppliers will be charged 
the fee for each form CMS-flSS they 
submit for enrollment or revalidation. 

Comment: A commenter stated that 
CMS should not allow contractors to 
revoke a provider’s billing privileges if 
an application fee or hardship waiver 
does not accompany a revalidation 
application, 

Response: We disagree. We believe 
that the failure to submit an application 
fee or hardship waiver with a 
reenrollment or revalidation application 
should be treated as the equivalent of 
the non-submission of the application, 
which is grounds for revocation under 
regulation §424.535(a)(6}. However, we 
understand the concern expressed and 
will Instruct our enrollment contractors 
to contact any enrolling or revalidating 
provider or sxtppller that does not 
submit the fee with the enrollment 
application and a^ord an opportunity to 
submit the fee. Thirty days after the date 
of the notification, the enrollment 
contractor would reject the application 
and revoke the billing privileges of the 
enrolled provider or supplier that has 
not submitted the fee. We have modified 
the regulation provisions in § 424, 514(g) 
to include the 30 day period. 

Comment: Several commenters 
requested clarification that changes of 
information, reactivations, and 
contractor-solicited, off-cycle 
revalidations do not require an 
application fee. 

Response: The ACA authorizes fees 
for new enrollment and revalidation of 
enrollment. Simple changes in the 
CMS-a55, for example, new phone 
numbers, new bank account 
information, new billing address(es), 
change in name of provider or supplier, 
or other such updates, do not constitute 
a new enrollment or a revalidation of an 


enrollment and therefore would not be 
subject to an additional fee. 

Comment: A commenter stated that 
there is no justification to assess new 
fees to providers to support CMS 
enforcement activities that should be 
ongoing in any event. Moreover, CMS’ 
proposed actions, the commenter 
contended, ignore the much more 
practical and effective measures to stem 
fraud and abuse outlined in H.R. 2479, 
and instead of stopping the fraud at the 
outset (as seems to be stated 
objective) rely unduly on 
straightforward delays in delivering 
payments to all providers. This 
punishes ail legitimate providers, and 
without any assurance that delays will 
solve the fraud problem. 

Response: Section ia66())(2)(C) of the 
Act authorizes the the Secretary to 
collect application fees from 
institutional providers and suppliers. 
This section also specifies that “the 
amounts collected as a result of the 
imposition of a fee under this 
subparagraph shall be used by the 
Secretary for program integrity efforts, 
including to cover the costs of 
conducting screening under this 
paragraph and to carry out this 
subsection and section 1126J of the 
Act.” We are implementing the 
provisions of the statute. The 
application fees collected will bo used 
for program integrity efforts as specified 
in the statute. 

Comment: A commenter stated that 
imposition of the fee on physicians who 
are enrolled as DMEPOS suppliers is 
unambiguously beyond the scope of 
CMS’s statutory authority, would 
frustrate congressional intent, and is not 
warranted, since the vast majority of 
physicians would not be subject to 
additional screening. 

Response: The fees are only paid by 
institutional providers and suppliers. If 
a physician is enrolled as a physician 
and also as a DMEPOS supplier, the fee 
is required only for the DMEPOS 
supplier enrollment. 

Comment; A commenter supported 
CMS's proposal to exempt physicians 
and non-physician practitioners from 
the application fee. The commenter 
stated that with a potential Medicare 
provider shortage on the horizon, 
introducing an application fee to these 
suppliers would only serve to drive 
more providers out of the Medicare 
system. 

Response: The ACA exempts 
physicians and non-physician 
practitioners from paying the 
application fee. 

Comment: A commenter stated that an 
appropriate course would be to process 
the application and require that if the 


application is accepted but the hardship 
waiver is denied, the application fee 
will be deducted from future payments. 
This certainly creates the risk that some 
applications would be considered for 
which no application fee payment was 
ultimately available, but that outcome is 
offset by the need to avoid draconian 
requirements with illusory protections. 

Response; The ACA requires 
institutional providers and suppliars 
that submit an application to enroll in 
or revalidate their enrollment in 
Medicare to pay the fee. Contractors 
should not process applications for new 
enrollment or revalidation of enrollment 
without a fee accompanying the 
application. In the case of an 
application that is accompanied by a 
request for a hardship waiver that is 
denied, the contractor will notify the 
provider or supplier that a fee is 
required for further processing. The 
provider or supplier has the option to 
submit the fee with the application and 
waiver request as a contingency to 
expedite processing should the hardship 
waiver be denied and the provider or 
supplier is concerned about delays 
associated with the time required to 
provide the fee. 

Comment: A commenter expressed 
concern that there was no exception for 
governmental providers, including those 
that are funded by Federal agencies. To 
permit Medicare and Medicaid, for 
instance, to impose enrollment fees on 
Indian and tribal providers merely 
transfers funds from one health system 
to Medicare and Medicaid. 

Response; Neither the ACA nor the 
proposed rule provide a blanket 
exemption from the fee for Federal 
institutional providers. Accordingly, we 
are unable to grant such an exception. 
However, Federal health care providers 
have the option to seek a hardship 
exception to the fee, and could request 
such an exception with any applications 
submitted to enroll in Medicare as an 
institutional provider. 

Comment: A commenter stated that if 
an application fee or hardship waiver 
request is missing from an application, 
the contractor should — consistent with 
§424.520 — treat this as a request for 
additional information and give the 
provider 30 days to furnish the missing 
items. 

Response; We agree, Consistent with 
§ 424.514(g)(3)(ii), contractors will be 
instructed to give providers and 
suppliers 30 days after the provider or 
supplier receives notification that the 
request for a hardship waiver is denied 
to submit the enrollment fee. 

Comment: A commenter stated that 
requiring two enrollment fees for a 
provider enrolling as two different 
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Medicare provider types — such as 
DMEPOS suppliers and mass 
immunizers — would be inconsistent 
with CMS’ proposed one-fee policy for 
dually enrolled providers, that is those 
enrolled in Medicare and Medicaid. 
Similarly, a commenter stated that if 
physicians functioning as DMEPOS 
suppliers for their patients are subjected 
to the additional screening mechanisms 
in the “Moderate” and “High” screening 
levels, many physicians will simply 
relinquish the services they provide as 
DMEPOS suppliers with minimal to no 
benefit to CMS's anti-fraud efforts. 

Response: The ACA specifically 
excludes physicians and nonphysician 
practitioners from paying the 
application fee. Physicians or non- 
physician practitioner organizations that 
elect to apply to enroll in Medicare as 
something other than a physician or 
nonphysician practitioner, for example, 
submitting an CMS-855S to enroll as a 
DMEPOS supplier, are applying to 
enroll as an institutional provider not as 
a physician or' nonphysician 
practitioner, Accordingly, applications 
to enroll as institutional providers are 
subject to submitting the application 
fee. Individual institutional providers 
that enroll in Medicare and Medicaid 
will be required to pay only one 
application fee per enrollment. Entities 
or individuals that enroll only in 
Medicare or only in Medicaid as more 
than one kind of institutional provider, 
for example, a DMEPOS supplier and a 
home health agency, will be required to 
submit the fee for each enrollment. 

Comment; A commenter suggested 
that providers submit one application 
for ail commonly-owned entities, with 
addenda to address each specific entity 
as needed, A single fee for each provider 
would be paid by the parent. The 
commenter added that if multiple 
application fees are required for 
roviders and suppliers wholly owned 
y the parent entity, a cap of $5,000.00 
per year in application fees should be 
instituted. 

Response: The ACA requires each 
institutional provider to pay the fee, in 
the amount specified in the statute. In 
general, most providers and suppliers 
must report each practice location on 
the enrollment Form CMS-855; 
however, the provider or supplier may 
list multiple practice locations on one 
Form CMS-855. The rules for DMEPOS 
suppliers, FQHCs and IDTFs are 
different; these entities must enroll each 
practice site separately — with separate, 
for CMS-855. Because of these 
differences among the different 
categories of providers and suppliers, 
we believe it is most prudent to rely 
upon the requirement that a provider or 


supplier will simply pay the application 
fee whenever a Form CMS— 855 is 
submitted. 

Comment; A commenter suggests that 
CMS specifically exempt physical 
therapists in private practice from 
paying an enrollment fee when 
enrolling as a DMEPOS supplier with 
NSC. The commenter acknowledges that 
physical therapists in private practice 
are listed under “eligible professionals,” 

Response: As with physicians, 
physical therapists that enroll as 
individual practitioners will be exempt 
from the fee. DMEPOS suppliers that are 
owned by a physical therapist are 
institutional providers and as a result 
are subject to the fee. 

Comment: A commenter stated that 
CMS should exempt recertification, re- 
enrollment, or other actions not related 
to a change in ownership from the 
application fee. 

Response: The ACA specifically 
provides for the fee to be paid for 
revalidating institutional providers, 
section 1666{j)(2}(C) of the Act. 

Comment: A commenter suggested 
that a provider or supplier enrolled in 
more than one program (that is, 
Medicare, Medicaid or CHIP) be subject 
to only one application fee. 

Response; We agree. Dually- 
participating providers and suppliers 
will only be subject to the application 
fee at the time of Medicare enrollment 
or revalidation. 

Comment: A commenter requested 
clarification on whether a fee is charged; 
(l) For each individual provider 
associated with a facility or institution, 
or (2) per facility. The commenter 
recommended a sliding fee based on the 
size and number of employees the 
facility has. 

Response; Under the ACA, a fee is 
required only from institutional 
providers. Therefore, if the commenter 
is referring to individual physicians or 
non-physician practitioners who are 
associated with an institutional provider 
or supplier, the individual physician or 
non-physician practitioner would not be 
required to submit an application fee. 
Only the facility or institutional 
provider with which they are associated 
would be required to submit the fee. If 
the commenter was referring to 
affiliated entities that would be 
considered institutional providers, then 
each of those institutional providers 
would be required to submit the fee as 
would the institutional provider with 
which they are associated. 

Comment: The same commenter also 
recommended a sliding scale for the fee 
that would be based on the size of the 
provider or facility and the number of 
employees. 


Response; The application fee is 
derived from a statutorily-mandated 
formula. Neither CMS nor the States 
have the discretion to change the 
amount of the fee, 

Comment: A number of commenters 
requested clarification regarding 
whether a State is required to collect the 
application fee for Medicaid-only or 
CHIP-only providers, or if the collection 
of this fee is at a State’s discretion. One 
commenter stated that it should 
continue to be at a State’s discretion. 

Response; Section 1866(j)(2)(C)(ii) of 
the Act requires that the fee be imposed 
for institutional providers, and the State 
will be required to collect the fee in the 
case of Medicaid-only and CHIP-only 
institutional providers. In addition to 
the providers and suppliers subject to 
the application fee under Medicare, 
Medicaid-only and CHIP-only 
institutional providers would include 
nursing facilities, intermediate care 
facilities for persons with mental 
retardation (ICF/MR), psychiatric 
residential treatment facilities, and may 
include other institutional provider 
types designated by a State in 
accordance with their approved State 
plan. Under section 1866(j)(2)(CKiii) of 
the Act, we may grant case-by-case 
exceptions to the application fee, based 
upon a demonstration of hardship, and 
in those instances, the State would not 
be required to collect the fee from 
Medicaid-only and CHIP-only 
institutional providers. Additionally, 
section 1866{j)(2)(C)(ii}) of the Act 
permits the Secretary to waive the 
application fee for providers enrolled in 
a State Medicaid program for whom the 
State demonstrates the imposition of the 
fee would impede beneficiary access to 
care. If a State is concerned that the 
imposition of the application fee may 
adversely impact beneficiary access to 
care, wo encourage them to seek a 
waiver of the fee in those circumstances. 

Comment: One commenter asked 
whether a State could choose to lower 
the fee from $500 to a different amount, 
for example, $250. 

Response: The amount of the 
application fee is derived from a 
statutorily-mandated formula. States do 
not have discretion to change the 
amount of the fee that is collected from 
Medicaid-only or CHIP-only 
institutional providers. 

Comment: One commenter asked that 
if a State elects not to collect the 
application fee, would the cost of 
screening be eligible for FFP. 

Response: As stated previously, 
Section 1866(j)(2)(C)(ii) of the Act 
requires that the fee be imposed for 
institutional providers, and the State 
will be required to collect the fee in the 
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case of Medicaid — only and CHIP — only 
institutional providers. However, to the 
extent that the costs associated with 
performing the screening exceed the 
amounts collected as a result of the 
application fees, these costs would be 
eligible for FFP. 

Comment: One commenter requested 
that CMS describe the process for 
determining whether the Medicaid and 
CHIP application fee exceeds the cost of 
provider screening. 

flesponse: States will be required to 
account for the costs of the provider 
screening program and measure it 
against total fees collected. If the cost of 
the program exceeds fees collected, then 
the State can claim FFP for excess cost, 
Note, that this requires that principles of 
0MB Circular A-87 be properly applied 
and that total fees collected serve as an 
applicable credit to the Medicaid 
program. 

Comment; One commenter requested 
that CMS confirm whether the 
application fee is intended to cover both 
State and Federal share of the costs. 

flesponse; The application fees 
collected by the State must be used to 
offset the total cost, both State and 
Federal share, of the screening program. 
As stated in the proposed rule, if the 
fees collected by a State agency exceed 
the cost of the State’s screening 
program, the State agency must return 
that portion of the fees to the Federal 
Government. 

Comment: One commenter asked if 
States would be eligible for enhanced 
Federal match for changes to provider 
enrollment and claims processing 
systems that implement reporting and 
screening requirements, 

Response: If the changes are to the 
MMIS for purposes of Medicaid 
provider enrollment and Medicaid 
claims processing, then States may be 
eligible for the ei^anced match rate 
(either 90 percent for enhancements/ 
new functionality or 75 percent for 
ongoing maintenance and operations!. 
States must contact their CMS Regional 
Office to determine whether an advance 
planning document (APD) is required, 

Comment; One commenter requested 
clarification on how the state should 
record expenditures on necessary MMIS 
changes to implement the rule, prior to 
collecting the application fee. 

Response: All State share costs 
including those involving the 
enhancement and operation of the 
MMIS in addition to administrative 
costs related to provider screening and 
reporting as specified in the proposed 
regulation (§ 455.460) are to be included 
in the screening program costs and 
offset by the application fees collected 
by the State. We understand that the 
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MMIS costs may be matched at higher 
rates (90 percent for development and 
75 percent for operation). States will be 
required to report the 10 percent and 25 
percent State share of the MMIS costs 
associated with the screening program 
and offset the application fee against 
such costs. In the event that the 
application fees are greater than the 
costs for the screening program for any 
reporting period, the State will refund 
the difference to CMS. Please refer to 
0MB Circular A-87, “Cost Principles for 
State, Local, and Indian Tribal 
Governments” for guidance in the 
reporting of the application fees as an 
iicable credit. 

omment: One commenter asked if 
the application fee is an allowable cost 
report expense for Medicaid and CHIP 
providers. 

Response: If a Medicaid-only or CHIP- 
only institutional provider is subject to 
the application fee. this could be 
considered an allowable cost report 
expense*. Thi.s determination would be 
governed by the State's approved 
reimbursement methodology within its 
State plan. 

Comment: One commenter asked if 
the amount of the fee could be included 
in determining a government provider's 
cost based rates. 

Response: Yes, if the application fee 
is imposed on e government 
institutional provider, then the amount 
of the fee could be included in 
determining the government provider’s 
cost-based rates. 

Comment: A few commenters asked if 
a State is permitted to have the 
applicant/provider pay the fees 
associated with fingerprinting and 
conducting criminal history checks. 

Response: The application fee is 
intended to cover the costs associated 
with the State’s Medicaid or CHIP 
provider screening program. It is 
permissible for the State to require the 
provider to pay the costs associated 
with capturing fingerprints. However, 
we expect that the amount of funds 
collected by imposition of the 
application fee should be used by the 
State to fund the costs incurred % the 
State associated with processing the 
fingerprints and conducting the 
criminal background checks. 

Comment: A number of commenters 
stated that local education agencies (that 
is, public schools) should be exempt 
from having to pay the application fee. 

Response; To the extent that a State 
determines, consistent with the 
approved State plan, that a local 
education agency is an institutional 
provider for purposes of this provision, 
then it would be subject to the 
application fee. 


Comment: A few commenters 
requested that CMS clarify whether the 
application fee applies to institutional 
providers only under Medicaid and/or 
CHIP, and what types of Medicaid and 
CHIP providers are considered 
institutional. 

Response; We will clarify in the 
regulation that the application fee does 
not apply to physicians or other 
individual non-physician practitioners 
such as nurse practitioners under 
Medicaid and/or CHIP, Medicaid-only 
and CHIP-only institutional providers 
that would be subject to the application 
fee include: Medicaid-only nursing 
facilities, intermediate care facilities for 
persons with mental retardation (ICF/ 
MR), and psychiatric residential 
treatment facilities. Additionally, a State 
may impose the application fee on other 
types of Medicaid-only or CHIP-only 
institutional providers, consistent with 
their approved Slate plan. 

Comment; One commenter asked if 
pharmacies are considered institutional 
providers for purposes of the 
application fee. 

Response; In the Medicare program, 
pharmacies are generally enrolled as 
DMEPOS suppliers, and thus are 
considered institutional providers for 
the purposes of the application fee. 
Therefore, pharmacies would be subject 
to the application fee, and it would 
likely be imposed at the time of 
Medicare enrollment or revalidation. 

Comment: One commenter suggested 
that the application fee requirement 
should provide an exception for 
providers that are required to pay a pre- 
existing State-level application or 
certification fee to enroll in the 
Medicaid program. 

Response; T^e enrollment screening 
activiUes are distinct from State- 
licensing and certification activities that 
seek to address conditions of 
participation or structures, processes 
and outcomes to support quality of care 
for the beneficiaries. The application fee 
is intended to support provider 
screening activities as part of 
enrollment. 

Comment: A number of commenters 
requested that CMS provide further 
guidance regarding the manner in which 
States will be expected to report the 
costs associated with screening. One 
commenter specifically requested 
whether CMS will want screening costs 
detailed per screening, per provider (for 
example, detailed travel expenses for 
site visits) or if a more generic reporting 
of screening cost is expected. 

Response; We anticipate that a State 
will be required to report the costs 
associated with its provider screening 
program on a semi-annual or annual 
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basis. Although we do not anticipate 
requiring States to routinely report very 
detailed information such as detailed 
travel expenses for a site visit, this 
information should be maintained by 
the State and be made available upon 
request if necessary for conducting an 
audit or other oversight activities. 
Additional guidance for States will be 
forthcoming regarding the specific form 
and manner of reporting. 

Comments; One commenter requested 
that CMS clarify whether the 
application fee be designed to include 
current program integrity activities, or 
whether the State will be expected to 
track the increased expenditures of PI 
activities resulting from this regulation 
separate from historic PI activities. 

Response; The application fee may 
only be used by the State to offset the 
cost of the provider screening program. 
It is not permissible for a State to design 
the fee in any manner that would 
include current program integrity 
activities. If the fees collected by a State 
agency exceed the cost of the screening 
program, the State agency must return 
that portion of fees to the Federal 
Government. 

Comment: One commenter 
recommended that CMS provide a 
comprehensive exception for out-of* 
State providers providing emergency 
services to managed care members, 
stating that such an exception would 
allow for timely access to critical 
services for managed care enrollees. 

Hesponse: After considering the 
comment, we are not inclined to 
provide a comprehensive exception to 
the application fee in this circumstance. 
Wo believe that the overwhelming 
majority of providers that provide 
emergency services to out-of-State MCO 
members are dually-participating 
providers, and would thus be subject to 
the application fee at the time of 
Medicare enrollment. Furthermore, 
there are additional Federal laws that 
exist to safeguard beneficiary well-being 
in emergency situations, such as, the 
Emergency Medical Treatment and 
Active Labor Act (EMTALA). 

Comment; A few commenters stated 
that each State should have the 
flexibility to waive the application fee, 
for particular providers or a class of 
providers, if it determines that this 
would help assure access to services for 
beneficiaries. 

Response; We agree and will clarify 
tbat a State, in consultation with the 
Secretary, may waive the application fee 
for Medicaid-only or CHIP-only 
providers if the State demonstrates that 
imposition of such a fee will impede 
beneficiary access to care. 


Comment; One commenter stated that 
providers who have already paid the fee 
to their own State’s Medicaid or CHIP 
program should also be exempt, if the 
provider is already enrolled in one and 
applies to the other. 

Response: We agree that providers 
enrolled in more than one program, be 
it Medicare, Medicaid, and CHIP, 
including Medicaid and CHIP in 
multiple States must only be required to 
pay the application fee once. 

Comment: One commenter urged 
CMS to expand the exemption 
provisions to allow an exemption for 
providers in medically underserved 
areas as well as those whose patient 
population are overwhelmingly 
Medicaid beneficiaries. 

Response: We are committed to 
assuring access to care and services for 
program beneficiaries and will clarify 
that a State, in consultation with the 
Secretary, may waive the application fee 
for Medicaid-onSy or CHIP-only 
providers if the State demonstrates that 
imposition of such a fee will impede 
beneficiary access to care. 

Comment; A few commenters 
expressed concern that requiring 
providers to pay a non-refundable 
application fee to participate in the 
Medicaid program will decrease the 
likelihood that providers will choose to 
participate. 

Response; We are committed to 
assuring access to care and services for 
program beneficiaries and will clarify 
that a State, in consultation with the 
Secretary, may waive the application fee 
for Medicaid-only or CHIP-only 
providers if the State demonstrates that 
imposition of such a fee will impede 
beneficiary access to care. 

Comment; A number of commenters 
requested clarification as to the process 
that a Medicaid agency would use to 
determine if a provider has paid an 
application fee to Medicare or another 
State. One commenter specifically 
requested clarification on whether the 
Medicare revalidation fee is applicable 
to payments made in one calendar year 
only when considered for Medicaid 
programfs). Will waiver programs honor 
fees made to Medicare? How will 
Medicaid honor a Medicare fee when 
the revalidation is a different time 
period? 

Response; The basic concept of the 
screening and enrollment provisions 
included in this regulation is that 
Medicaid will accept Medicare 
screening for providers that receive 
payments from both Medicare and 
Medicaid. For dually-participating 
providers, the application fee is 
imposed at the time of Medicare 
enrollment and no additional screening 


fee is imposed by the State regardless of 
the time period or revalidation cycle. 

For institutional providers that 
participate only in Medicaid, the State 
Agency is responsible for assuring that 
the provisions of the regulation are met. 
Institutional providers will be required 
to submit the application fee to only one 
program. We believe these operational 
logistics are more appropriately 
addressed in subregulatory guidance. 

We will be issuing subregulatory 
guidance to assist States with the 
operational aspect of implementing this 
provision in the near future. 

Comment; One commenter supported 
the proposal that for dually 
participating providers, the application 
fee would be imposed at the time of 
Medicare enrollment. 

Response; We agree and are finalizing 
this provision accordingly. 

Comment: One commenter 
encouraged CMS to consider 
establishing a lower price point or 
expedited review for providers in the 
lower risk group. 

Response; The amount of the 
application fee is derived from a 
statutorily-mandated formula. Neither 
CMS nor the States have discretion to 
change the amount of the fee that is 
collected from Medicaid-only or CHIP- 
only institutional providers. 

Commenf; One commenter requested 
clarification that ongoing resubmissions 
do not trigger the application fee and 
that the fee will merely be levied 
through the actual recertification 
process. 

Response; The ACA authorizes fees 
for new enrollment and revalidation of 
enrollment. Simple changes to the 
provider enrollment information, that is, 
new phone numbers, new bank account 
information, new billing address, 
change in name of provider or other 
such updates are not subject to the fee. 
They will apply to newly-enrolling 
providers, revalidating providers and 
creation of new practice locations. 

Comment: A commenter noted that 
the application fee and other provisions 
are effective on March 23, 2011. The 
commenter stated, however, that CMS 
must first complete the notice and 
comment rulemaking process. The 
commenter recommended that CMS 
implement the application fee only after 
a final regulation has been issued and 
the public has been given at least 60 
days notice. 

Response; We agree with the 
commenter and we are finalizing the 
regulation in regard to the application 
fee. It will be displayed for 60 days prior 
to the effective date on March 25, 2011, 

Comment: A commenter stated that 
some of the provider types listed under 
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the definition of “institutional provider” 
do not bill Medicare on a fee-for-service 
basis. For example, RHCs and FQHCs 
bill Medicare on a cost-based, all- 
inclusive rate basis. The commenter 
believes this distinction is significant 
because on past occasions when the 
Congress authorized certain incentive 
payments and linked those payments to 
the “fee-for-service” payment, RHCs and 
FQHCs were excluded from those 
incentive payment programs. The 
commenter believes it was unfair to 
deny certain providers from 
participating in programs because they 
are not “fee-for-service,” but then 
mandate their inclusion in other 
initiatives reserved for “fee-for-service” 
providers. Moreover, the commenter 
stated that RHCs and FQHCs are by 
definition located in areas designated as 
underserved or serving populations 
with a demonstrated problem accessing 
the healthcare delivery system, 

Imposing an application fee on these 
providers will only ser\'e as a further 
barrier to access to care, The commenter 
believes that the term “institutional 
providers” should exclude new entities 
seeking designation as RHCs and FQHCs 
and include only those providers that 
bill Medicare on a fee-for-service basis. 
Another commenter believes that the 
term “institutional provider” refers to 
providers whose beneficiaries are 
institutionalized; the proposed rule’s 
envisioned use of the term is therefore 
inappropriate. The commenter 
suggested using the term “non- 
institutional provider.” 

i?e.?ponse: in the NPRM, we proposed 
a definition of institutional provider 
that does not distinguish among 
providers or suppliers based on which 
version of the form 855 they submit, or 
•whether they submit the form 
electronically. We are finalizing this 
definition. The distinction on payment 
methods the commenter suggests is not 
related to the definition of institutional 
provider used in this rule. Physician 
and practitioner organizations are 
exempt from the application fee by 
statute; the exemption is not affected by 
how they are reimbursed, In addition, 
the inpatient status of patients has no 
bearing on whether a provider or 
supplier is considered an institutional 
provider in this rule. For example, 
hospitals are institutional providers as 
are home health agencies and DMEPOS 
suppliers. 

If certain institutional providers and 
suppliers such as FQHCs and RHCs may 
face financial obstacles to paying the 
application fee, they can seek a waiver 
of the fee based upon a request for a 
hardship exception for Medicare or a 
request for a hardship waiver for 


Medicaid. Newly enrolling institutional 
providers and suppliers that are seeking 
such a waiver must submit a request for 
the hardship exception at the time of 
filing a Medicare enrollment application 
on or after March 25, 2011. 

Comment: A commenter stated that 
the proposed rule indicates that the fee 
will be applied only to those providers 
that bill “Medicare, Medicaid, or CHIP 
on a fee-for-service basis.” The 
commenter stated that most Indian and 
tribal providers are reimbursed either on 
the encounter rates established annually 
by CMS and IHS for Indian health 
programs or on FQHC encounter rates. 
The commenter requested clarification 
as to whether Indian and tribal 
providers will therefore be exempt from 
the application fee. The commenter 
added that the proposed rate of increase 
in the fee has often exceeded the 
increase in funding for Indian and tribal 
programs. Finally, the commenter stated 
that CMS failed to seek an exchange of 
views, information, or advice from the 
Tribal Technical Advisory Group 
(TTAG) or to consult directly with 
Tribes or confer with urban Indian 
organizations. Unless Indian and tribal 
health programs are exempt from these 
rules, the commenter believes that the 
effective date should be delayed, 
discussions with the TTAG and 
consultation with Tribes held, after 
which the proposed rules with any 
changes that result from the advice and 
consultation be published with a new 
comment period. 

Response: We are statutorily unable to 
exempt IHS, Tribal, and Urban fl/T/U) 
Indian health programs from these rules 
or to delay the effective date. Moreover, 
we do understand Tribal concerns about 
not having the opportunity to provide 
advice on this regulation. All I/T/U's are 
eligible to apply for the hardship 
exception to the application fee and 
CMS is committed to working with 
Tribes, the TTAG and I/T/Us in 
implementing requests for hardship 
exceptions. 

4. Final Application Fee Provisions — 
Medicare, Medicaid, and CHIP 

This final rule with comment period 
finalizes the provision of the proposed 
rule in regards to the application fees 
with the following exceptions: 

In §424.514, we modified our 
proposal as follows; 

■ Added language to clarify that a 
provider or supplier may submit both an 
application fee and hardship exception 
waiver to avoid delays in the processing 
of the application if the hardship 
exception is not approved at 
§ 424.514la) and (b). 


• Added language at §424. 514(d)(2) 
clarifying that the application fee is 
non-refundabie except in the 
circumstance where the provider or 
supplier opts to submit both an 
application fee and a hardship waiver 
request and the waiver request is 
subsequently approved. 

• Added language to clarify that if a 
provider submits a hardship exception 
request without an application fee, and 
CMS does not approve the hardship 
exception request, CMS will notify the 
provider or supplier and allow the 
provider or supplier thirty {3Q) days 
from the date of notification to submit 
the application fee at § 424.514(h). 

• Added language that specifies that 
States must collect the applicable 
application fee from Medicaid-only and 
CHIP'Only providers and suppliers at 
§455.460, 

C. Temporary Morotoria on Enrollment 
of Medicare Providers and Suppliers, 
Medicaid and CHIP Providers 

1. Statutory Changes 

Section 6401(a) of the ACA amended 
section 1866(i) of the Act by adding a 
new section 1866(j)(7) of the Act, which 
provides that the Secretary may impose 
temporary moratoria on the enrollment 
of new Medicare, Medicaid, or CHIP 
providers and suppliers, including 
categories of providers and suppliers, if 
the Secretary determines such moratoria 
are necessary to prevent or combat 
fraud, waste, or abuse under the 
programs. 

Section 6401(b)(1) of the Act adds 
specific moratorium language applicable 
to Medicaid at section 1902(^kk)(4) of the 
Act. requiring States to comply with any 
temporary moratorium imposed by the 
Secretary unless the State determines 
that the imposition of such moratorium 
would adversely affect Medicaid 
beneficiaries’ access to care. Section 
1902(kk){4)(B) of the Act further permits 
States to impose temporary enrollment 
moratoria. numerical caps, or other 
limits, for providers identified by the 
Secretary as being at high risk for fraud, 
waste, or abuse, if the State determines 
that the imposition of such moratorium, 
cap, or other limits would not adversely 
impact Medicaid beneficiaries’ access to 
care. 

Section 1866(j)(7) of the Act uses the 
term “providers of services and 
suppliers.” Although, as noted 
previously, the Medicaid program does 
not use the term “suppliers,” section 
1902(kk){4) of the Act refers to 
“providers and suppliers.” In this 
regulation, for uniformity with sections 
II A. and B. of this final rule with 
comment period, we are using the term 
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“providers and suppliers” in lieu of the 
term “provider of services and 
suppliers.” We are using the term 
“provider” or “Medicaid provider” or 
“CHIP provider” in lieu of the term 
“provider or supplier” when referring to 
all Medicaid or CHIP health care 
providers, including, but not limited to, 
providers and suppliers of Medicaid 
items or services, individual 
practitioners, and institutional 
providers. 

2. Proposed Temporary Moratoria 

Provisions 

a, Medicare 

We proposed at § 424.570(a) that we 
may impose a temporary moratorium on 
the enrollment of new Medicare 
providers and suppliers in 6 month 
increments in situations where — 

(1) CMS, based on its review of existing 
data, without limitation, identifies a 
trend that appears to be associated with 
a high risk of fraud, waste or abuse, 
such as highly disproportionate number 
of providers or suppliers in a category 
relative to the number of beneficiaries or 
a rapid increase in enrollment 
applications within a category suggests 
that there is a significant potential for 
fraud, waste or abuse with respect to a 
particular provider or supplier type or 
particular geographic area or both; (2) a 
State has imposed a moratorium on 
enrollment in a particular geographic 
area or on a particular provider of 
supplier type or both; or (3) CMS, in 
consultation with the HHS OIG or the 
Department of justice (DOJ) or both and 
with the approval of the CMS 
Administrator identifies either or both 
of the following as having a significant 
potential for fraud, waste or abuse in the 
Medicare program; 

* A particular provider or supplier 
type, 

• Any particular geographic area. 

As part of the CMS decision making 

process, we will consider any 
recommendation from the DOJ, HHS 
OIG, or the GAO to impose a temporary 
moratorium for a specific provider or 
supplier type in a specific geographic 
area. 

We believe that imposing moratoria 
will, among other things, allow us to 
review and consider additional 
programmatic initiatives, including the 
development of additional regulatory 
and sub regulatory provisions to ensure 
that Medicare providers and suppliers 
are meeting program requirements, 
beneficiaries receive quality care, and 
that an adequate number of providers of 
suppliers exists to furnish services to 
Medicare beneficiaries. 

We also proposed that enrollment 
moratoria be limited to: (1) Newly 


enrolling providers and suppliers (that 
is, initial enrollment applications); and 
(2) the establishment of new practice 
locations, not to a change of practice 
locations. The temporary moratoria will 
not apply to existing providers or 
suppliers of services unless they were 
attempting to expand operations to new 
practice locations where a temporary 
moratorium was imposed. Moreover, the 
temporary moratoria would not apply in 
situations involving changes in 
ownership of existing providers or 
suppliers, mergers, or consolidations. 

We also proposed at §424.S70(b) that 
a temporary enrollment moratorium 
w'ould be imposed for a period of 6 
months, and such moratorium could be 
extended by CMS in 6 month 
increments if we continue to believe 
that a moratorium is needed to prevent 
or combat fraud, waste, or abuse. The 
Secretary will re-evaluate whether a 
moratorium should continue prior to 
each 6 month expiration date. 

We also proposed at § 424.570(c) that 
we will deny enrollment applications 
received from providers or suppliers 
covered by an existing moratorium. We 
noted that denial of Medicare billing 
privileges is subject to the 
administrative review process 
established in §405.874. Accordingly, 
we believe that a provider or supplier 
also is afforded the right to appeal a 
Medicare contractor determination to 
deny enrollment into the Medicare 
program. 

In §424.530(a)(10}, we proposed 
adding a new reason why we can deny 
Medicare billing privileges. Specifically, 
we proposed a new §424.530(a)(10) to 
state, “A provider or supplier submits an 
enrollment application for a practice 
location in a geographic area where 
CMS has imposed a temporary 
moratorium.” Further, in § 490.5(l)(4), 
we proposed that the scope of review for 
appeals of denials under 
§ 424.530(aKl0) based upon a provider 
or supplier being subject to a temporary 
moratorium will be limited to whether 
the temporary moratoria applies to that 
particular provider or supplier. 

We noted that section 18G6(j){7) of the 
Act provides that there shall be no 
judicial review of a temporary 
moratorium. Accordingly, we proposed 
that a provider or supplier may 
administratively appeal an adverse 
determination based on the imposition 
of a temporary moratorium up to and 
including the Department Appeal Board 
(DAB) level of review. 

Finally, we proposed at § 424.570(d) 
that we may lilt a moratorium in the 
following circumstances: (l) In the case 
of a Presidentiaily declared disaster 
under the Robert T. Stafford Disaster 


Relief and Emergency Assistance Act, 

42 U.S.C. 5121 through 5206 (Stafford 
Act); (2) circumstances warranting the 
imposition of a moratorium have abated 
or CMS has implemented program 
safeguards to address any program 
vulnerability that was the basis for the 
moratorium; or (3) in the judgment of 
the Secretary, the moratorium is no 
longer needed. 

We also recognized that in a limited 
number of circumstances a State 
Medicaid agency may enroll a provider 
or supplier into Medicaid during the 
temporary moratorium period 
established by Medicare. If this occurs 
and the prospective Medicare provider 
or supplier applies to enroll in the 
Medicare program after the temporary 
moratorium is lifted, we would use the 
screening tools described in section II.A. 
of this final rule with comment period. 

We also solicited public comment on 
specific exemptions to the temporary 
moratoria criteria proposed previously. 
Prior to imposing a moratorium, we 
would assess Medicare beneficiary 
access to the type(s) of services that are 
furnished by the provider or supplier 
type and/or within the geographic area 
to which the moratorium would apply, 

We would announce the 
implementation of a moratorium at any 
time when it is being imposed. The 
announcement would be made in the 
Federal Register and we would also 
address it in other methods or forums, 
such as Press Releases, at CMS Provider 
Open Door Forums, in CMS provider 
listservs, and on the CMS Provider/ 
Supplier Enrollment web page [http:// 
wmv.cms.gov/MedicareProviderSup 
Enroll). We would also require our 
Medicare contractors to post the 
moratorium announcement or note the 
expiration of a moratorium on their Web 
sites. Our Federal Register 
announcement would explain in detail 
the rationale for the moratorium and the 
rationale for the geographic area(s) in 
which it would apply, 
b. Medicaid and CHIP 

Pursuant to section 1902(kk)(4)(A) of 
the Act, we proposed at § 455.470(a)(2) 
and (3) that a State Medicaid agency 
will comply with a temporary 
moratorium imposed by the Secretary 
unless it determines that the imposition 
of such a moratorium would adversely 
affect beneficiaries' access to medical 
assistance. 

Where the Secretary has imposed a 
temporary moratorium in accordance 
with § 424.570, and the State has 
determined that compliance with such a 
moratorium would adversely impact 
Medicaid beneficiaries’, or CHIP 
participants’, as the case may be, access 
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to medical assistance, section 
1902(kk)(4)(A){ii) of the Act creates an 
exception for the State from complying 
with the moratorium. We proposed that 
the State provide the Secretary with 
written details of the moratorium’s 
adverse impact on Medicaid 
beneficiaries. Prior to the Secretary 
imposing such a moratorium in any 
State, we proposed at § 455.470(a)(1) 
that the Secretary consult with the State, 
so that the State may have an 
opportunity to seek an exception from 
the moratorium. 

Pursuant to section 1902(kk)(4)(B) of 
the Act, States have authority to impose 
moratoria, numerical caps, or other 
limits for providers that are identified 
by the Secretary as being at “high” risk 
for fraud, waste, or abuse. We proposed, 
at § 455.470(b) that where the State 
identifies a category of providers as 
posing a significant risk of fraud, waste, 
or abuse, the State must seek our 
concurrence with that determination 
and provide us with written details of 
the proposed moratorium, including the 
anticipated duration, and with a 
substantial justification explaining why 
disallowing newly enrolling providers 
would reduce the risk of fraud, We 
proposed at § 455.470(c} that States' 
moratoria would be imposed for a 
period of 6 months and may be 
extended in 6 month increments, 

Section 2107(e)(1) of the Act provides 
that all provisions that apply to 
Medicaid under sections 1902{a)(77) 
and 1902(kk) of the Act apply to CHIP. 
Accordingly, we proposed in new 
regulation §457,990 that all the 
provider screening, provider 
application, and moratorium regulations 
that apply to Medicaid providers also 
apply in providers that participate in 
CHIP. 

3. Analysis of and Responses to Public 
Comment 

Below is a summary of the comments 
we received regarding the temporary 
enrollment moratoria. 

Comment.- A commenter expressed 
support for our proposal to establish a 
moratorium on new providers or new 
practice locations only when it is 
believes through the agency’s review 
that a risk of fraud and abuse is 
detected. The commenter, however, 
requested CMS to: (1) To review the 
proposed 6-month timeframe for the 
moratoria, (2) add more flexibility to the 
standard if it is determined that 6 
months is too long, and (3) give the 
provider community an opportunity to 
comment prior to its effective date. 
Another commenter stated that a 
moratorium is a drastic remedy that 
should only be used when CMS can 


clearly articulate the basis for imposing 
such an extreme measure. CMS must, in 
such cases, publish: (1) The data it used 
to determine a moratorium was 
necessary, ( 2 ) the steps it will take to 
resolve ^e issues that gave rise to the 
need for the moratorium, and (3) when 
it expects to lift the suspension in new 
enrollments. 

Response: We believe that the rule as 
proposed directly addressed the 
timeframe, standards, and process for 
imposing, explaining the rationale for, 
and lifting an enrollment moratorium; 
because we received multiple related 
comments, this response should be read 
in conjunction with the discussion of 
those comments. The ACA gives the 
Secretary broad authority to impose a 
temporary moratorium on the 
enrollment of new providers and 
suppliers if the Secretary determines 
that a moratorium is necessary to 
prevent fraud, waste or abuse in 
Medicare, Medicaid or CHIP. After 
considerable discussion within CMS 
and HHS. the proposed rule was 
published proposing that an initial 
temporary enrollment moratorium 
would be imposed for a period of 
6 months, with possible extensions in 6- 
month increments should the Secretary 
determine that the moratorium was still 
needed. The 6-month duration was 
proposed in the NPRM because it was 
sufficiently long to enable an 
assessment of its impact on the 
drcumstances that the moratorium was 
designed to address. 'The proposed rule 
also included criteria for when the 
Secretary would consider imposition of 
a temporary enrollment moratorium, 
and the circumstances under which 
such a temporary enrollment 
moratorium would be lifted. The 
proposed rule also indicated that we 
would announce the implementation of 
a moratorium at any time, that the 
announcement would be made in the 
Federal Register, and that the 
announcement would explain in detail 
the rationale for the moratorium and the 
rationale for the geographic area(s) in 
which it would apply. 

Comment: A commenter stated that 
advance public notice in the Federal 
Register of a moratorium should be 
given. The commenter recognized that 
this may lead to a rush to apply prior 
to the effective date, but stated that this 
could be fixed by limiting the length of 
time for the advance notice to 30-60 
days. 

Response; A temporary moratorium 
on enrollment is an action that will only 
be used if necessary to fight fraud, waste 
or abuse in Medicare, Medicaid, or 
CHIP. Moratoria will be imposed only if 
based on detailed information 


indicating a problem that can be 
addressed through a temporary 
enrollment moratorium. Although not 
required by the ACA to do so, we will 
announce the imposition of a 
moratorium in the Federal Register, The 
announcement would explain in detail 
the rationale for the moratorium and the 
rationale for the geographic area(s) in 
which it would apply. We will not be 
providing advance notice of any 
planned moratorium as such a notice 
would likely cause a rush of 
enrollments of the type posing the 
problem tliat would be addressed by the 
moratorium. 

Commenf; Several commenters stated 
that applying a moratorium to providers 
whose enrollment applications are 
pending would be unfair and could— in 
light of the efforts and cost the provider 
incurred in attempting to enrol! — prove 
financially harmful. They requested that 
CMS limit moratoria to new 
applications, not those already 
submitted. Another commenter 
requested that the moratorium not apply 
to applications submitted prior to public 
notice of the moratorium being given in 
the Federal Register. Another 
commenter recommended that CMS 
explain; (1) What will happen to an 
application submitted by a new 
provider when CMS imposes a 
temporary moratorium, and (2) whether 
pending applications will be processed 
when a temporary moratorium is 
imposed or whether the application will 
be automatically denied using 
§424.530(a)(10). 

Response: In the NPRM, we indicated 
both in the preamble and the proposed 
regulations that an application to enroll 
in Medicare from a provider or supplier 
that is subject to a temporary enrollment 
moratorium would be denied. With 
regard to pending applications, we 
interpret the ACA as applying to 
pending applications. If a temporary 
enrollment moratorium is deemed 
necessary for any provider or supplier 
type, or for any geographic area, then all 
enrollment applications from 
unenrolled providers and suppliers of 
the type subject to the temporary 
enrollment moratorium or in the 
geographic area subject to the 
moratorium would be denied. However, 
we will not deny any enrollment for 
which the Medicare enrollment 
contractor has completed review of the 
application and has determined that the 
provider or supplier meets all the 
requirements for enrollment and all that 
remains is to assign appropriate billing 
number(s) and enter Ae provider or 
supplier into PECOS. 

Comment: A commenter stated that in 
CMS’s manual instructions, it describes 
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a provider enrollment fraud detection 
program for high-risk areas, but that this 
process is not discussed in the proposed 
rule. The commenter requested that 
CMS explain the nexus, if any, between 
this fraud detection program and the 
policy described in the temporary 
moratorium provisions contained in this 
proposed rule. The commenter also 
requested that CMS explain whether it 
will use data submitted or obtained 
from its contractors in determining 
whether to impose a temporary 
moratorium. 

Response: We plan to revise our 
manuals to be consistent with the 
provisions of the final rule with 
comment period. We plan to use data 
from many sources in making a decision 
about imposing a temporary 
moratorium — including data from our 
contractors. 

Comment.' One commenter 
recommended that CMS; (1) Explain 
why it is not using section 1866(j)(3) of 
the Act, related to a provisional period 
of enhanced oversight for new providers 
and suppliers, in the process of 
establishing a temporary moratorium, 
and (2) publish a Federal Register 
Notice explaining its reasons and 
rationale for establishing a temporary 
moratorium for a provider or supplier. 

Response; Section 1866(})(3) of the 
Act is not a part of this final rule with 
comment period. Moreover, its 
provisions can be implemented by 
subregulatory instructions. We plan to 
implement the provisions in that 
fashion and in concert with the 
provisions of this rule and other CMS 
regulations governing program integrity. 
As stated in a response to a previous 
comment, we will publish a notice of 
imposition of a temporary enrollment 
moratorium in the Federal Register. 

Comment; One commenter expressed 
concern that the language associated 
with the temporary moratoria provision: 
(1) Is vague, (2) does not provide 
sufficient information on the specific 
triggers that would cause CMS to 
suspect that a provider or group of 
providers is committing fraud, and (3) 
does not identify the situations in which 
the moratoria would be applied. The 
commenter feared that certain providers 
or suppliers could be prevented from 
providing services in a particular area 
without sufficient grounds and that 
patient access to care could be hindered 
in the process. The commenter 
recommended that CMS specifically 
define the parameters and triggers that 
CMS intends to use in imposing or 
enforcing a moratorium on the 
enrollment of new Medicare providers 
or suppliers. Another commenter 
expressed concern with the general 


nature of the proposed temporary 
moratoria provisions because it could 
lead to an abuse of discretion or 
arbitrary and capricious decision- 
making with little recourse beyond the 
internal review process. The commenter 
was also concerned with the proposed 
length of the moratorium, stating that a 
6 month period: (l) Cannot be 
reasonably inferred from the Congress 
having authorized “temporary" 
moratoria, (2) cannot be considered 
“temporary,” (3) would have significant 
consequences for new physicians 
interested in enrolling in the Medicare 
program, and .(4) should not be extended 
because there is no congressional 
authority to do so. 

Response: As stated previously, the 
Affordable Care Act gives the Secretary 
broad authority to impose a temporary 
moratorium. After considerable 
discussion within CMS and HHS, the 
proposed rule was published proposing 
that an initial temporary enrollment 
moratorium would be imposed for a 
period of 6 months, with possible 
extensions in six month increments 
should the Secretary determine that the 
moratorium was still needed. The 6 
month duration was proposed in the 
NPRM because it was sufficiently long 
to enable an assessment of its impact on 
the circumstances that the moratorium 
was designed to address, and would 
afford us the opportunity to determine 
whether the circumstances warranting 
the imposition of a temporary 
enrollment moratorium have abated or 
we have implemented program 
safeguards to address program 
vulnerabilities. With regard to the 
temporary nature of a moratorium, we 
would note that the NPRM explicitly 
indicated that an initial moratorium 
would be for a 6 month period, not an 
indefinite period. Regarding the impact 
a temporary enrollment moratorium 
would have on beneficiary access to 
care, we stated in the NPRM that we 
will assess Medicare and Medicaid 
beneficiaries’ and CHIP participants 
access' to the types of services that are 
furnished by the provider or supplier 
type and/or within the geographic area 
to which the moratorium would apply. 
We take seriously our responsibility to 
assure that all Medicare beneftciaries 
have access to the services and supplies 
they need. With regard to extending 
moratoria, we would note that, as stated 
previously, the Secretary has broad 
authority to impose a moratorium. The 
statute confers on the Secretary the 
responsibility and authority to make the 
judgment about the need for moratoria — 
whether initial or an extension — if the 


circumstances requiring the moratorium 
are still present. 

Comment: A commenter stated that 
CMS failed to outline the criteria it will 
use to make the determination that a 
moratorium is to be extended. 

Response: We would not impose a 
temporary enrollment moratorium 
withoxit an adequate rationale. Should it 
be necessary to impose a temporary 
enrollment moratorium on any provider 
or supplier type, we will discuss the 
issues associated with the decision to 
impose a temporary enrollment 
moratorium in a public notice in the 
Federal Register. 

In the NPRM, we listed some 
examples of circumstances that could 
lead to the imposition of a temporary 
enrollment moratorium in situations 
where: (1) CMS, based on its review of 
existing data, identifies a trend that 
appears to be associated with a high risk 
of fraud, waste or abuse, such as highly 
disproportionate number of providers or 
suppliers in a category relative to the 
number of beneficiaries or a rapid 
increase in enrollment applications 
within a category determines that there 
is a significant potential for fraud, waste 
or abuse with respect to a particular 
provider or supplier type or particular 
geographic area or both, (2) a State has 
imposed a temporary enrollment 
moratorium, or (3) CMS in consultation 
with the Department of HHS Office of 
Inspector General or the Department of 
Justice or both identifies either or both 
a particular provider or supplier type or 
a particular geographic area as having 
significant potential for fraud, waste, or 
abuse. We also included in the NPRM 
the reasons a temporary enrollment 
moratorium could be lifted. The 
decision to, extend a moratorium would 
be based on the proposals in the NPRM 
and would take into account the extent 
to which the conditions necessitating 
the moratorium were still present. 

Comment: A commenter requested 
clarification regarding the term 
“geographic area” as it is used in 
proposed § 424.530(a)(10). 

Response: The geographic area 
referred to in § 424.530(a)(30) is the 
region that is under a temporary 
enrollment moratorium. For example, 
this may constitute a county, a number 
of counties, state, a number of states, 
regions, or MSAs, 

Comment: A commenter expressed 
support for QMS's proposal to impose a 
temporary moratorium on the 
enrollment of new providers or provider 
types in a geographic location to prevent 
fraud and abuse. However, the 
commenter urged CMS to ensure that 
such moratoria do not prevent health 
care providers in the geographic 
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location from enrolling as an ordering/ 
referring provider, as a moratorium may 
impair these practitioners from 
providing Medicare beneficiaries with 
needed care. 

flesponse; We take seriously our 
responsibility to assure that all 
Medicare beneficiaries have access to 
the services and supplies they need. As 
a part of this assurance, we would 
consider the implications of a temporary 
enrollment moratorium for physicians 
and other eligible professionals who 
order and refer services for Medicare. 
However, enrollment moratoria imposed 
on provider types will not distinguish 
between the enrollment purpose, diat is, 
enrollment for the right to bill Medicare 
versus enrollment solely to order and 
refer, unless otherwise specified in the 
Federal Register. As stated previously, 
the notice in the Federal Register will 
both discuss the issues associated such 
the decision, and identify the provider 
types subject to the temporary 
enrollment moratoria. We believe the 
rationale that supports a decision to put 
a temporary enrollment moratorium in 
place for those who bill Medicare 
should extend to those same types of 
providers who seek to enroll to order 
and refer. In addition, the enrollment 
process solely to order and refer was 
established by xis for those provider 
types that do not typically enroll in 
Medicare, such as dentists, other 
government agency employees (such as 
the Department of Veterans Affairs), and 
pediatricians. Therefore, it will be 
highly unlikely that those who were 
seeking to enroll in order to bill 
Medicare will similarly seek to enroll 
solely to order and refer. Regarding the 
impact a temporary enrollment 
moratorium may have on beneficiary 
access to needed care, we stated in the 
NPRM that we will assess Medicare 
beneficiary access to the types of 
services that are furnished by the 
provider or supplier type and/or within 
the geographic area to which the 
moratorium would apply. 

Comment; A commenter supported 
CMS’s statement in the preamble to the 
proposed rule that a moratorium shall 
not apply to a change of practice 
location or to changes of ownership of 
existing providers or suppliers. 

Response: We agree and plan to 
finalize these provisions. 

Comment; A commenter 
recommended that CMS establish a 
temporary moratorium on the 
enrollment of slide preparation 
Facilities, since these organizations are 
not authorized by the Congress to enroll 
in or bill the Medicare program. 

flesponse.’It would be premature to 
identify in this rule any provider or 


supplier type that might be subject to 
imposition of a temporary enrollment 
moratorium. Should it be necessary to 
impose a temporary enrollment 
moratorium on any provider or supplier 
type, we will explain the reasons for the 
temporary enrollment moratorium in a 
public notice in the Federal Register. 

Comment; A commenter 
recommended that CMS develop and 
implement a regulatory-defined process 
to utilize when determining whether or 
not to mandate a moratorium. The 
process should effectively prevent any 
negative impact in quality of and access 
to care for Medicare beneficiaries or 
Medicaid program enroilees. 

Response: We would consider a 
number of factors in deciding whether 
to impose a temporary enrollment 
moratorium. These are spelled out in 
the proposed rule and include: 
situations where: (1) CMS, based on its 
review of existing data, identifies a 
trend that appears to be associated with 
a high risk of fraud, waste or abuse, 
such as highly disproportionate number 
of providers or suppliers in a category 
relative to the number of beneficiaries or 
a rapid increase in enrollment 
applications within a category 
determines that there is a significant 
potential for ffaud, waste or abuse with 
respect to a particular provider or 
supplier type or particular geographic 
area or both, (2) a State has imposed a 
temporary enrollment moratorium, or 
(3) CMS in consultation with the 
Department of HHS Office of Inspector 
General or the Department of Justice or 
both identifies either or both a 
particular provider or supplier type or a 
particular geographic area as having 
significant potential for ffaud, waste, or 
abuse. 

As mentioned elsewhere, we 
indicated in the NPRM that prior to 
imposing a temporary enrollment 
moratorium we would assess Medicare 
beneficiary access to the type(s) of 
services that are furnished by the 
provider or supplier type and/or within 
the geographic area to which the 
moratorium would apply, We also 
indicated that if a State has determined 
that compliance with a Medicare 
imposed moratorium would adversely 
impact Medicaid beneficiaries’ or CHIP 
participants’ access to care, the State 
would not be required to comply with 
the moratorium. We and the States take 
the assurance of adequate access 
seriously. 

Comment: A commenter requested 
clarification as to the mechanism — for 
instance, via the Federal Register — by 
which it will announce the lifting of a 
temporary moratorium. 


Response; We will announce the 
imposition of any temporary enrollment 
moratorium via a notice published in 
the Federal Register. We would also 
provide notice on our Web sites, 
listservs, and through open door forums, 
Similarly, we would provide notice of 
the lifting of a moratorium in the 
Federal Register. We would also 
provide notice on our Web sites, 
listservs, and through open door forums. 

Comment: A commenter mentioned 
that while the preamble of the proposed 
rule states that CMS will announce a 
moratorium in the Federal Register, the 
regulation text does not include a 
reference to Federal Register. The 
commenter recommended that the 
regulation text match the preamble 
language. 

Response: We agree. We will ensure 
that the regulation text matches the 
preamble and other portions of this 
document. 

Comments; A commenter urged CMS 
to immediately impose the proposed 6 
month moratorium on the new 
certification of HHAs and hospices in its 
final rule with comment period, stating 
that there is a clear relationship between 
rapid development of new home health 
and hospice providers and the growth in 
fraud, abuse and waste. The commenter 
added that this will allow some time for 
other initiatives and proposals in the 
proposed rule to reduce ftaud and abuse 
before hundreds of more providers enter 
the already saturated home health and 
hospice programs. For home health, the 
commenter stated that the moratorium 
should be maintained until new home 
health conditions of participation (CoPs) 
are implemented by CMS and other 
protections against referral abuse can be 
implemented by the OIG. For hospices, 
the commenter recommended that the 
moratorium be maintained until 
standardized hospice quality measures 
and payment system reforms are 
implemented by CMS. 

Response; It would be premature to 
identify any provider or supplier type 
that might tie subject to imposition of a 
temporary enrollment moratorium, or 
the circumstances necessitating such an 
action. Should it be necessary to impose 
a temporary enrollment moratorium on 
any provider or supplier type, we will 
explain the reasons for the temporary 
enrollment moratorium in a public 
notice in the Federal Register. We 
specified in the NPRM examples of why 
a moratorium would be imposed. 
“Revisions to the HHA Conditions of 
Participation” is not among the 
examples we cited for the reason that 
moratoria are focused on specific kinds 
of problems or areas, and are to be 
temporary. 
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Comments; A commenter requested 
that CMS clarify the process for timely 
notifying the State Medicaid agency of 
a moratorium imposition, and whether 
the process will include advance notice. 

Response: We will be issuing 
subreguiatory guidance to assist States 
with the operational aspect of 
implementing this provision in the near 
future. 

Comments: A commenter stated that 
while a temporary moratorium might be 
reasonable in some limited situations, 
CMS should make such decisions based 
on specialty, not on provider type; for 
instance, it would be inappropriate for 
all DMEPOS suppliers to be put under 
such a moratorium when fraud concerns 
do not include orthotists and 
prosthetists. 

Response; The ACA gives the 
Secretary broad authority to impose a 
temporary enrollment moratorium. We 
believe that circumstances could justify 
imposing a temporary enrollment 
moratorium on a category of providers 
or suppliers and not a subset within a 
provider or supplier type. As stated 
previously, the Secretary would explain 
the reasons for the moratorium in a 
Federal Register notice. 

Comment: A commenter stated that 
the proposed policies need to be 
modified to accommodate newly 
enrolling physicians (and physicians 
establishing new practice locations) in 
cases where a moratorium relates to 
DMEPOS suppliers. In other words, if 
CMS or a State imposes a moratorium 
on DMEPOS suppliers, the moratorium 
should not apply to newly enrolling 
physicians (or physicians establishing a 
new practice location) who are now also 
required to enroll as DMEPOS suppliers 
if they wish to furnish DMEPOS to their 
own patients. 

Response; In the example cited by the 
commenter, physicians enrolled as 
physicians to provide medical care 
would not be subject to a moratorium on 
DMEPOS suppliers, Only the new 
DMEPOS suppliers would be subject to 
the temporary enrollment moratorium. 
Physicians would be able to enroll in 
Medicare as physicians for the purpose 
of providing medical care (or ordering 
or referring medical care or services). 
The moratorium would only apply to 
the physician if he or she were newly 
applying to be a DMEPOS supplier in 
the geographic area covered by the 
moratorium. 

Comment: A commenter suggested 
that CMS specify that a moratorium will 
not be imposed unless: (1) There is 
significant risk of widespread fraud, 
waste, or abuse in a specified and 
discrete geographic region, and (2) clear 
and documented agency analysis 


showing that the moratorium will not 
exacerbate health disparities or create 
additional barriers for underserved 
communities. Also, CMS should include 
greater specificity as to what conditions 
would warrant the imposition of a 
moratorium and what fartors would be 
considered to ensure that the harm does 
not outweigh the benefit and will not 
have a disparate adverse impact on 
racially and ethnically diverse 
beneficiaries and physicians. 

Response: We appreciate the concerns 
expressed by the commenter and we are 
also concerned about the issues of 
access and disparities. As mentioned 
previously, we indicated in the 
proposed rule that prior to imposing a 
temporary eiunilment moratorium we 
will assess Medicare beneficiary access 
to the type(s) of services that are 
furnished by the provider or supplier 
type and/or within the geographic area 
to which a moratorium would apply. 

We also indicated that if a State has 
determined that compliance with a 
Medicare imposed moratorium would 
adversely impact Medicaid 
beneficiaries' or CHIP participants’ 
access to care, the State would not be 
required to comply with the 
moratorium. CMS and the States take 
the assurance of adequate access 
seriously. We do not intend to impose 
a moratorium that would impede access 
to needed services. 

Comment: A commenter expressed 
concern that CMS's proposed standards 
for implementing a temporary 
moratorium on new enrollment of 
potentially high risk providers and 
suppliers is too broad, and that CMS 
could impose a moratorium on new 
enrollment of all DMEPOS suppliers, 
even though only a subset of suppliers 
or a particular region or State poses a 
high risk of fraud. CMS should specify 
that it will narrowly limit the moratoria 
to those provider types or those narrow 
geographic regions mat generate the 
fraud concerns. In particular, the 
commenter stated that community 
pharmacies face the danger that, in the 
midst of preparing to open up. CMS will 
impose a moratorium. The commenter 
urged that the expansion of an existing 
community pharmacy DMEPOS 
supplier does not pose a fraud risk and 
such an expansion should not be subject 
to a possible moratorium. Another 
commenter stated that CMS should 
adopt a more targeted approach to 
moratoria that takes other relevant 
factors into consideration, such as the 
history or trend in proven fraud and/or 
abusive practices for specific types or 
categories of providers or suppliers. The 
commenter believes that painting all 
providers and suppliers in a particular 


geographic area with the same broad 
brush is too extreme a measure, and that 
CMS should not use geography, by 
itself, as a determining factor in 
imposing a temporary enrollment 
moratorium on all providers and 
suppliers. 

Response; As stated elsewhere in this 
document, we will publish a notice in 
the Federal Register announcing 
imposition of a temporary enrollment 
moratorium. This notice would contain 
a discussion of the factors associated 
with the moratorium. Although there 
are clear differences in the levels of 
fraud in different geographic areas of the 
United States, geography by itself 
without any indication of a risk of fraud, 
waste or abuse would not be a cause for 
a moratorium. Community pharmacies 
generally enroll in Medicare as roster 
billers for purposes of immunizations, 
and as such are listed in the limited risk 
level. DMEPOS suppliers that are 
ow'ned by a community pharmacy are 
enrolled in Medicare as DMEPOS 
suppliers and are subject to the supplier 
standards for DMEPOS suppliers 
(except accreditation under certain 
circumstances). If we, on behalf of the 
Secretary, determine that a moratorium 
is needed for any particular provider or 
supplier type or geographic area or both, 
we would publish our rationale for the 
moratorium in our Federal Register 
notice. Decisions to impose a temporary 
enrollment moratorium would be made 
based on presenting circumstances. It 
would not be appropriate to exclude any 
provider or supplier category, for 
example, DMEPOS suppliers owned by 
community pharmacies, from being 
subject to a moratorium if the ' 
circumstances warrant the imposition of 
a temporary enrollment moratorium, 

Comment: Several commenters 
recommended that CMS also be 
permitted to lift a moratorium if the 
Secretary of HHS declares a public 
health emergency in an area. 

Response: The ACA gives the 
Secretary broad authority to impose 
temporary enrollment moratoria as a 
means to combat fraud, waste or abuse. 
The Secretary has considerable 
discretion to consider all aspects of the 
impact of a possible temporary 
moratorium. In the NPRM we proposed 
that the Secretary may lift a moratorium 
in the following three circumstances: (1) 
The President declares an area a disaster 
under the Robert T. Stafford Disaster 
Relief and Emergency Assistance Act, 

(2) circumstances warranting imposition 
of moratorium have abated or we have 
implemented safeguards to address the 
issue that was the cause of such 
moratorium, or (3) in the judgment of 
the Secretary, the moratorium is no 
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longer needed. Based on the comments 
received in response to the NPRM, and 
consistent with the broad authority 
provided to the Secretary in the 
Affordable Care Act, we have decided to 
add a public health emergency declared 
by the Secretary under section 319 of 
the Public Health Service Act to the list 
of circumstances the Secretary could 
cite in lifting a moratorium. We would 
closely evaluate these circumstances in 
the decision to continue a temporary 
enrollment moratorium. 

Comment.’ A commenter suggested 
that CMS include the restrictions listed 
in the preamble regarding temporary 
moratoria in the regulation text at 
§424.570. 

Response; It is unclear which 
provisions included in the preamble of 
the NPRM are of concern to the 
commenter. However, w’e will include 
any provisions dealing with imposition 
of temporary' enrollment moratoria at 
§424.570. 

Comment: A commenter asserted that 
new § 424.570 is inconsistent with the 
DMEPOS competitive bidding program. 
Under competitive bidding, a company 
might win a contract in a competitive 
bidding area (CBA) where a moratorium 
exists. If so, the company could not alter 
its geographic locations to best serve the 
CBA. The commenter requested that 
CMS in the final rule with comment 
period carefully delineate how the 
competitive bidding program and the 
proposed temporary moratoria 
requirements will intersect. 

Response; All winners of DMEPOS 
competitive bidding contracts are 
required to be enrolled in Medicare as 
a condition of their contract. As a result, 
these suppliers would not likely be 
subject to a moratorium on enrollment 
after they were awarded a contract, as 
they would already be enrolled. 
However, in a situation where a 
competitive bid winner applied to 
expand to a new practice location, the 
new location would need to be enrolled 
in Medicare. If a moratorium were 
imposed on DMEPOS suppliers in the 
area where the competitive bid winner 
was attempting to enroll a new practice 
location, the application would in all 
likelihood be denied based on the 
existence of a moratorium. 

Comment; The same commenter also 
suggested that: (1) Suppliers with 10 or 
more provider transaction account 
numbers (PTANs) be exempt from 
§424.570 and (2) CMS allow exceptions 
for bona fide acquisitions of assets 
belonging to an existing provider in the 
area for the protection of the 
beneficiaries served by the selling 
provider. 


Response: We will be applying the 
provisions of this rule to all enrolled 
physicians, individual practitioners, 
providers end suppliers regardless of 
the number of PTANs. In addition, as 
stated in the NPRM, changes in 
ownership are not subject to moratoria. 
Moreover, the provisions of this rule do 
not address the conditions under which 
a provider or supplier can complete a 
bona fide acquisition of assets. 

Comment: Several commented stated 
that new locations of enrolled suppliers 
should not be subject to a moratorium, 
Existing suppliers with no history of 
fraud should not be constrained in their 
ability to adjust their businesses to best 
meet the needs of beneficiaries; indeed, 
beneficiary access could be impaired if 
new locations were affected by a 
moratorium. Another commenter stated 
that applying a moratorium to a new 
location should only occur when the 
supplier has an objectively 
demonstrated history of fraud or for 
whom CMS has credible evidence of 
fraud. 

Response: As mentioned elsewhere in 
this document, a temporary enrollment 
moratorium would not be imposed 
without adequate rationale. The 
decision to impose a temporary 
enrollment moratorium would not be 
made lightly and would only be 
pursued should one or more of the 
conditions for imposing a temporary 
moratoria exist — as described in the 
proposed rule. One factor for imposing 
a moratorium could be that — as stated in 
the NPRM — there are a disproportionate 
number of providers or suppliers 
relative to the number of beneficiaries. 
For example, currently enrolled 
providers and suppliers that ara trying 
to enroll in or establish new practice 
locations in areas subject to a 
moratorium that has been imposed 
because there is a disproportionate 
number of a particular provider category 
relative to beneficiaries, should not be 
exempt from the moratorium. 

Comment; A commenter stated that 
given that the intensity of a Certificate 
of Need program is designed to limit the 
number of providers to match 
beneficiary need, an exception to a 
temporary moratorium should be 
granted in the presence of such a 
program. Another commenter agreed 
that an exemption to the moratorium 
should be given if the State has a 
Certificate of Need program and the 
State determines that there is a need for 
additional providers. Several 
comment's also recommended 
exceptions to a moratorium when a 
provider is establishing a branch 
location within its geographic service 
area. Branch locations are subject to the 


oversight of the established parent 
location and operate under the same 
Medicare provider number. Another 
commenter stated that the addition of a 
branch office to an HHA is not the 
equivalent of “establishing a new 
practice location,” 

Response; We have decided not to 
provide a link to State CON programs 
because these programs vary in 
effectiveness and are subjecd to different 
standards, coverage and regulations and 
are not focused on fraud, waste or abuse 
prevention as would be a temporary 
enrollment moratorium that is 
authorized in the ACA. To provide an 
exemption in States with CON programs 
would require considerable effort to 
assure that all provider types are 
afforded dne process and equal 
treatment. Accordingly, we did not 
propose an exemption from temporary 
enrollment moratoria in States with 
CON programs. We plan to take into 
account the impact a CON has on 
provider supply and beneficiary access 
when deciding to impose a moratorium, 
Regarding the HHA branch offices, we 
note that the extent to which the branch 
office is subject to a moratorium 
depends on whether the branch office i.s 
to be enrolled separately. 

Comment: A commenter stated that 
the proposal to allow unlimited 6 month 
extensions without thorough 
documentation of supporting data 
hardly makes the moratoria temporary 
and could pose a significant risk to 
access to quality care for Medicare 
beneficiaries. 

Response; The ACA gives the 
Secretary broad authority to impose a 
temporary moratorium on the 
enrollment of new providers and 
suppliers if the Secretary determines 
that a moratorium is necessary to 
prevent fraud, waste or abuse in 
Medicare, Medicaid or CHIP. The 
statute did not provide a specific time 
period for the duration of a moratorium, 
After considerable discussion within 
CMS and HHS, the proposed rule was 
published proposing that an initial 
temporary enrollment moratorium 
would be imposed for a period of 6 
months, with possible extensions in 6 
month increments should the Secretary 
determine that the moratorium was still 
needed. We proposed the 6 month 
duration because it would be 
sufficiently long to enable an 
assessment of its impact on the 
circumstances that the moratorium was 
designed to address, and would afford 
us the opportunity to determine 
whether the circumstances warranting 
the imposition of a temporary 
enrollment moratorium have abated or 
whether we have implemented program 
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safeguards to address program 
vulnerabilities, The 6 month period 
would also afford the Secretary 
reasonable opportunity to determine 
whether the moratorium was no longer 
needed. With regard to the temporary 
nature of a moratorium, we would note 
that the NPRM explicitly indicated that 
an initial moratorium would be for a 6 
month period, not an indefinite period. 
Regarding the impact a temporary 
enrollment moratorium would have on 
beneficiary access to needed care, we 
stated in the NPRM that we will assess 
Medicare beneficiary access to the types 
of services that are furnished by the 
provider or supplier type and/or within 
the geographic area to which the 
moratorium would apply. We take 
seriously our responsibility to assure 
that ail Medicare beneficiaries have 
access to the services and supplies they 
need. With regard to extending 
moratoria, the statute confers on the 
Secretary the responsibility and 
authority to make the judgment about 
the need for moratoria — whether initial 
or an extension — if the circumstances 
requiring the moratorium are still 
present. 

Comment: A commenter stated that as 
part of the implementation of a 
temporary moratorium and any 
extension thereof, CMS should publish 
data and research that support their 
decision to impose the moratorium. The 
data should be thorough and indicate 
the “actual increased” risk rather than 
perceived risk for fraud and abuse, in 
addition to supportive materia! data. 
Another commenter added that CMS 
should ensure that beneficiary access is 
not curtailed in an area where a 
moratorium is imposed. 

Response: As stated earlier, the ACA 
gives the Secretary broad authority to 
impose temporary enrollment moratoria 
when necessary to prevent or combat 
fraud, waste or abuse. We will announce 
any temporary enrollment moratoria in 
the Federal Register, including a 
discussion of the issues associated with 
the decision to impose a temporary 
enrollment moratorium. We are 
concerned about the effect imposition of 
a temporary enrollment moratorium 
would have on beneficiary access, and 
would consider access to care as one 
possible factor related to imposition of 
a moratorium. The ACA specifically 
mentions access to Medicaid services as 
a reason that States should consider in 
making decisions to implement 
moratoria. 

Comment; A commenter stated that 
the proposed rule should be amended to 
stale that a moratorium does not apply 
to instances where the new provider is 
a result of a merger, change of 


ownership, or consolidation. Also, the 
fact that the moratorium would not 
apply where there is a change in 
practice location should be stated 
directly in the rule. 

Response: We agree. All of these 
instances are addressed in the hnal rule 
with comment period. 

Comment; A commenter requested 
that FQHCs be exempt from any 
geographical moratoria established by 
CMS. FQHCs are required to contract 
with State Medicaid and CHIP programs 
within certain specified locations. 
Inclusion in a moratorium would force 
these FQHCs to provide services 
without compensation. 

Response: The ACA gives the 
Secretary authority to impose a 
moratorium when necessary to combat 
fraud waste and abuse in Medicare, 
Medicaid, or CHIP. Should there ever be 
a reason to impose a temporary 
enrollment moratorium on FQHCs, we 
would need to be able to do so. As 
mentioned previously, we indicated in 
the NPRM that prior to imposing a 
temporary enrollment moratorium we 
would assess Medicare beneficiary 
access to the type(s) of services that are 
furnished by the provider or supplier 
type and/or within the geographic area 
to which the moratorium would apply. 
We also indicated that if a State has 
determined that compliance with a 
Medicare imposed moratorium would 
adversely impact Medicaid 
beneficiaries’ or CHIP participants' 
access to care, the Stale would not be 
required to comply with the 
moratorium. We and the States take the 
assurance of adequate access seriously. 

Comment: The commenter also stated 
that Indian and Tribal providers should 
be exempt from the temporary moratoria 
provisions, as their programs are not 
viable without third-party revenue 
(especially Medicare and Medicaid) and 
that a moratorium could impede the 
programs and harm access to care. 

Response; The ACA gives the 
Secretary authority to impose a 
temporary enrollment moratorium when 
necessary to combat fraud, waste and 
abuse in Medicare, Medicaid, or CHIP. 
Should there ever be a reason to impose 
a temporary enrollment moratorium on 
Indian or Tribal providers, we would 
need to be able to do so. As mentioned 
previously, we indicated in the NPRM 
that prior to imposing a temporary 
enrollment moratorium we would assess 
Medicare beneficiary access to the 
type(s) of services that are furnished by 
the provider or supplier type and/or 
within the geographic area to which the 
moratorium would apply. We also 
indicated that if a State has determined 
that compliance with a Medicare 


imposed moratorium would adversely 
impact Medicaid beneficiaries’ or CHIP 
participants’ access to care, the State 
would not be required to comply with 
the moratorium. We and the States take 
the assurance of adequate access 
seriously. 

Comment: A commenter stated that 
the moratorium exceptions should be 
very limited. The commenter agreed 
with CMS’s proposal for an exemption 
for health crisis situations related to. for 
example, a natural disaster. The 
commenter also recommended that 
exceptions should be granted in areas: 
(l) With active CON programs, (2) not 
being served by any provider or 
(3) where the provider(s) (other than the 
applicant for the exception) attest that 
they lack the capacity to meet current 
demand. Still, the commenter stated 
that exemptions should only be granted 
in such exceptional circumstances and 
not become a vehicle for routine 
circumvention of the moratorium. 

Response: We agree with the intent of 
these comments. Temporary enrollment 
moratoria must be considered carefully 
and the reasons for their imposition 
must be clear, Prior to imposing a 
moratorium, we will consider a number 
of factors, such as, any potential effect 
on access to care for beneficiaries. CON 
programs are not factored in to CMS 
decisions regarding exceptions. 

Comment; A commenter requested 
clarification as to whether the 
temporary moratoria provisions apply to 
managed care organizations. 

Response; This provision does not 
apply to Medicaid managed care 
entities. Medicaid risk based managed 
care is subject to contracts between 
States and the managed care entities, 
and the States rely upon those contracts 
to ensure that Medicaid beneficiaries 
have access to providers and a choice of 
networks within the managed care 
programs the State maintains. We would 
not impose moratoria on managed care 
programs that could restrict the ability 
of States to ensure beneficiary access 
and choice. 

Comment; A commenter stated that an 
enrollment moratorium should not 
apply to publicly traded companies, 
since CMS can look to the board of 
directors and similar organizational 
structures to provide appropriate 
oversight and accountability. Moreover, 
after a moratorium is lifted, publicly 
traded providers and suppliers that 
were subject to the moratorium should 
not be lifted to a high screening level; 
to do so would be inconsistent with 
CMS’s own statements in the preamble 
that publicly traded providers and 
suppliers pose a limited risk. 
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Besponse: It would be inappropriate 
for us to identify any one provider or 
supplier characteristic, such as being 
publicly traded, as a basis for not being 
subject to a temporary enrollment 
moratorium. In addition, as noted 
below, in the screening portion of this 
final rule with comment period, we 
have decided not to draw a distinction 
between publicly traded and other 
providers and suppliers. Should there 
ever be a reason to impose a temporary 
enrollment moratorium in a geographic 
area or on a particular provider or 
supplier category; we would need to be 
able to do so. We cannot state that there 
will never be circumstances that 
warrant imposition of a temporary 
enrollment moratorium that will affect 
providers and suppliers that are 
publicly traded or that these providers 
and suppliers will never be subject to a 
temporary enrollment moratorium. We 
have in response to many comments on 
this issue, has decided to eliminate the 
distinction between publicly traded and 
non-publicly traded status as a 
determinant of assignment of provider 
or supplier types to risk levels. 
Temporary enrollment moratoria will 
not be imposed without adequate 
rationale for how the moratorium would 
address fraud, waste and abuse in 
Medicare, Medicaid and CHIP. Such 
moratoria would be imposed based on 
careful analysis and assessment of 
circumstances that are present. 

Comment: CMS, according to one 
commenter, states repeatedly that the 
application of the temporary moratoria 
could be to either a particular provider 
or supplier type or a particular 
geographic area. The commenter urged 
CMS to reconsider whether it is 
appropriate to ever apply moratoria on 
particular geographic areas for all 
provider and supplier types — such as 
physicians, whom CMS assigns to the 
limited level of screening. The 
commenter believes that physicians 
.should be exempt from geographic 
provider/supplier enrollment moratoria. 

Response: We would not likely 
impose a temporary enrollment 
moratorium on all provider and supplier 
types in a particular geographic area 
particularly given the potential impact 
on beneficiary access. However, if 
circumstances were to be such tliat a 
temporary enrollment moratorium in a 
particular geographic area should apply 
to all provider and supplier types in that 
area, we would need to be able to 
impose such a moratorium. As stated 
elsewhere in this document, we would 
publish notice of any moratorium and 
would include in the notice the 
rationale for the imposition of a 
temporary enrollment moratorium. 


Also, as stated earlier, we vrould 
consider access issues as well. 

Commenf; A commenter urged that 
the final rule with comment period be 
revised to clarify that it is only to be 
used as an option of last resort, when 
less onerous enforcement efforts have 
failed to reduce program abuse by a 
significant number of providers or 
suppliers of the same type. The 
commenter also stated that it should be 
imposed only if there is irrefutable 
evidence of fiaud, waste or program 
abuse by a significant portion of the 
population of providers that are targeted 
by the moratorium. 

Response.- The ACA gives the 
Secretary broad authority to impose 
temporary enrollment moratoria in 
instances where the Secretary has 
determined that the moratorium is 
necessary to combat fraud, waste or 
abuse in Medicare, Medicaid or CHIP. A 
moratorium would not be imposed 
without adequate justification. We 
would announce in the Federal Register 
the imposition of any temporary 
enrollment moratorium and would 
include a discussion of the issues 
associated with the decision to impose 
the temporary enrollment moratorium. 

In the NPRM, we did list 
circumstances that could lead to the 
imposition of a temporary enrollment 
moratorium in situations where: (1) 
Based on our review of existing data, 
identifies a trend that appears to be 
associated with a high risk of fiaud, 
waste or abuse, such as when a highly 
disproportionate number of providers or 
suppliers in a category relative to the 
number of beneficiaries or a rapid 
increase in enrollment applications 
within a category is associated with a 
significant potential for baud, waste or 
abuse with respect to a particular 
provider or supplier type or particular 
geographic area or both, (2) a State has 
imposed a temporary enrollment 
moratorium, or (3) CMS in consultation 
with the Department of HHS Office of 
Inspector General or the Department of 
Justice or both identifies either or both 
a particular provider or supplier type or 
a particular geographic area as having 
significant potential for baud, waste, or 
abuse. We also included in the NPRM 
the reasons a temporary enrollment 
moratorium could be lifted. The 
decision to extend a moratorium would 
be based on the proposals in the NPRM 
and would take into account the extent 
to which the conditions necessitating 
the moratorium were still present. 

Commenf; A commenter stated that 
CMS and Medicaid should be permitted 
to extend a temporary moratorium by a 
maximum of one additional 6 month 
period. Twelve months is more than a 


sufficient amount of time for CMS to 
consider additional programmatic 
initiatives. The commenter added that 
CMS’s statement in the preamble that it 
“would assess Medicare beneficiary 
access to the type(s) of services that are 
furnished by the provider or supplier 
type and/or within the geographic area 
to which the moratorium would apply” 
before Imposing a moratorium, should 
be included in the regulatory text. 

Response: We reserve the option to 
extend a temporary moratorium if 
circumstances warrant the continuation. 
We do not want to limit our ability to 
keep a temporary enrollment 
moratorium in place if necessary. 
Conversely, if the Secretary determines 
that a moratorium is no longer needed, 
consistent with the provisions of the 
proposed rule, the moratorium could be 
lifted at any time. We have modified the 
regulation text to make this clarification. 
We will consider safeguards for 
beneficiary access related to the 
imposition of an enrollment moratorium 
at §424.570. 

Comment; A commenter stated that 
CMS should exempt new practice 
locations from the moratoria and should 
limit the moratorium to newly-enrolling 
providers and suppliers. 

Response: Currently enrolled 
providers and suppliers that are trying 
to establish additional new practice 
locations as a means to enroll in areas 
that are subject to a moratorium, and the 
provider is of the type for which the 
temporary enrollment moratorium is 
imposed, should not be exempt from the 
moratorium. However, if an enrolled 
provider or supplier is merely changing 
its practice location from a current 
location to a new location — not an 
additional new location — then that new 
location would not be subject to a 
temporary enrollment moratorium. 

Comment: A commenter stated that 
CMS should establish an administrative 
appeals mechanism to address adverse 
determinations based on tbe imposition 
of a temporary moratorium that would 
also permit providers and suppliers to 
question whether CMS has an 
appropriate statutory or evidentiary 
basis for imposing a temporary 
moratorium. 

Response: The ACA specifies that 
there is no judicial review under 
sections 1869 and 1878 of the Act, or 
otherwise of the decision to impose a 
temporary enrollment moratorium 

However, as stated in the NPRM, we 
note that a provider or supplier may use 
the existing appeal procedures at 42 
CFR part 498 to administratively appeal 
a denial of billing privileges based on 
the imposition of a temporary 
moratorium, 
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Comment: One commenter stated that 
CMS should allow exceptions to the 
moratorium, such as: (1) A low ratio of 
the provider or supplier type to the 
number of beneficiaries in the targeted 
area, {2} pandemics and other threats to 
beneficiary health that would be served 
by the provider or supplier type, and (3) 
other circumstances as the Secretary or 
the State Medicaid director determine 
are in the best interests of the program. 

Response; As discussed previously, 
the ACA gives the Secretary broad 
authority to impose temporary 
enrollment moratoria. We also stated 
earlier that we listed in the NPRM 
circumstances that could lead to the 
imposition of a temporary enrollment 
moratorium in situations. We also 
indicated in the NPRM that prior to 
imposing a temporary enrollment 
moratorium we would assess Medicare 
beneficiary access issues. And we 
indicated that if a State has determined 
that compliance with a Medicare 
imposed temporary enrollment 
moratorium would adversely impact 
Medicaid beneficiaries’, or CHIP 
participants’ access to care, the State 
would not be required to comply with 
the temporary enrollment moratorium, 
We and the States take the assurance of 
adequate access seriously. 

Comment; A commenter believes that 
CMS moratoria authority was open- 
ended to the point where CMS could, 
towards the end of a fiscal year, 
announce the suspension of provider 
enrollment in a variety of categories not 
to stem fraud and abuse, but rather to 
achieve some budgetary goal of reducing 
Medicare expenditures. The commenter 
requested that CMS clarify: (l) Who will 
decide what constitutes a highly 
disproportionate number of providers 
relative to the number of beneficiaries, 
(2) the standards that will be used to 
determine the number of providers 
necessary relative to the number of 
beneficiaries, and (3) whether this is a 
de facto return of the certificate of need 
process. 

Response: We proposed and sought 
comments on factors that would have to 
be in place to impose a temporary 
enrollment moratorium, including 
identifiable trends in CMS data, State 
imposition of a moratoria, or 
consultation with the Office of Inspector 
General or the Department of Justice, 

The ACA requires that any moratorium 
imposed be implemented to reduce 
fraud, waste and abuse in the Medicare, 
Medicaid and CHIP programs. 
Additionally, we will not deny any 
enrollment for which the Medicare 
enrollment contractor has completed 
review of the application and has 
determined that the provider or supplier 


meets all the requirements for 
enrollment and all that remains is to 
assign appropriate billing numberfs) and 
enter the provider or supplier into 
PECOS. Actively enrolled providers and 
suppliers will still be reimbursed for 
claims for services that are provided, 
and reimbursement would be at levels 
preceding the moratoria. The process for 
imposing a moratorium in this rule 
provides no opportunity for us to use 
the temporary enrollment moratoria to 
stop payments to enrolled providers and 
suppliers, and there is no intention for 
us to use temporary moratoria for 
purposes other than the ones authorized 
under the ACA. 

Additionally, as stated previously, we 
would provide notice in the Federal 
Register of the imposition of a 
temporary enrollment moratorium and 
would include a discussion of the issues 
associated with the decision to impose 
a temporary enrollment moratorium. We 
will decide what constitutes a 
disproportionate number of providers 
relative to beneficiaries. We indicated in 
the NPRM that prior to imposing a 
temporary enrollment moratorium we 
would assess Medicare beneficiary 
access to the type(s) of services that are 
furnished by the provider or supplier 
type and/or within the geographic area 
to which the temporary enrollment 
moratorium would apply. As a part of 
this process, we would examine the 
levels of providers in a given area and 
make a judgment about whether any 
temporary enrollment moratorium 
would adversely affect the delivery of 
needed services to beneficiaries. 
Regarding Certificate of Need processes, 
we would note that a number of States 
use the CON process. We have stated 
elsewhere in this document that we 
have not linked this proposed rule to 
the CON process. The CON programs 
vary in effectiveness and coverage and 
are subject to different standards and 
regulations. If there were a need to 
impose a temporary enrollment 
moratorium in any part of a State that 
has a CON requirement, we would 
impose the temporary enrollment 
moratorium in that part of the State, as 
needed. 

Comment: A commenter stated that 
CMS should exclude from any moratoria 
those providers and suppliers; 

(1) Assigned to the limited level of 
screening, and (2) that have completed 
and passed a State licensure process. 
Another commenter urged that a 
moratorium be applied only to 
providers included within the moderate 
or high screening levels, and then only 
after: (1) Appropriate appeals measures 
have been established, and (2) CMS has 


addressed any beneficiary access to care 
issues. 

Response; The ACA provides that the 
Secretary can impose a moratorium if 
she decides that it is necessary to 
combat fraud, waste or abuse, 
Accordingly the decision to impose a 
temporary enrollment moratorium will 
be based on a variety of factors, 
including the potential risk of fraud in 
the Medicare program that could be 
posed by a particular category of 
provider or supplier in a specific 
geographic area. The ACA gives the 
Secretary authority to impose a 
moratorium when necessary to combat 
fraud waste and abuse in Medicare, 
Medicaid, or CHIP. Should there ever be 
a reason to impose a temporary 
enrollment moratorium on any category 
of providers or suppliers, we would 
need to be able to do so — regardless of 
the screening level to which they were 
assigned as part of the provider and 
supplier screening process described in 
this regulation. We cannot state that 
providers and suppliers in the “limited” 
screening level will never be subject to 
a temporary enrollment moratorium. 

Nor are we prepared to state that 
providers or suppliers that are licensed 
would never be subject to a temporary 
enrollment moratorium. With regard to 
access to care, we indicated in the 
NPRM that prior to imposing a 
temporary enrollment moratorium we 
would assess Medicare beneficiary 
access to the typels) of services that are 
furnished by the provider or supplier 
type and/or within the geographic area 
to which the temporary enrollment 
moratorium would apply. We also 
indicated that if a State has determined 
that compliance with a Medicare 
imposed temporary enrollment 
moratorium would adversely impact 
Medicaid beneficiaries’, or CHIP 
participants’ access to care, the State 
would not be required to comply with 
the temporary enrollment moratorium. 
We and the States take the assurance of 
adequate access seriously. 

Comment; A commenter stated that 
while the preamble mentions that 
advanced notice of a moratorium will be 
given, this is not specified in the 
regulation text. The commenter stated 
that the text should be amended to 
reflect the advanced notice req^uirement. 

Response; The preamble to the 
proposed rule says that we will 
announce the imposition of a temporary 
enrollment moratorium in the Federal 
Register. The preamble does not say we 
will give advance notice. We have stated 
in response to other comments that we 
do not think we should provide advance 
notice as this may foster an increase in 
applications for enrollment in an 
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attempt to circumvent the intent of the 
temporary enrollment moratorium, 
Accordingly, we did not include any 
language about advance notice in the 
regulation text. 

Comment: A commenter requested 
clarification as to what the term 
“significant potential for fraud” means 
in the context of the moratorium and the 
datasets that will be used to determine 
whether such a trend exists. 

Response: We offered examples in the 
NPRM of the kinds of circumstances 
that might warrant imposition of a 
temporary enrollment moratorium. We 
plan to draw on data and information 
from many sources in coming to a 
decision about imposition of temporary 
enrollment moratoria — including 
existing CMS claims and enrollment 
data as well as other public data as well 
as data from our conUactors or from law 
enforcement entities. 

Comment: A commenter noted that 
CMS proposes to allow a Medicare 
enrollment moratorium where a State 
Medicaid program has imposed a 
moratorium on a group of providers 
who are also eligible to enroll in 
Medicare. The commenter stated that 
the proposal does not clarify whether 
CMS intends for such a moratorium to 
apply only to those providers within the 
affected State or whether that 
moratorium could apply nationwide in 
the event that the moratorium pertains 
to provider type. The commenter 
believes that for a State-imposed 
moratorium to have such a drastic effect 
across the country without evidence of 
a nationwide problem would be an 
overly broad and unnecessary 
imposition of CMS authority, and urged 
CMS to craft this provision more 
narrowly. 

Response; We agree that imposing a 
moratorium on a national level based on 
one State’s action in its State would be 
an unnecessarily broad action for us to 
take. The intent of that provision in the 
NPRM was to afford Medicare the 
option to adopt a State moratorium in a 
State or part of a State if appropriate. 

Comment: A commenter stated that in 
the case of a moratorium, CMS and the 
States should explain their actions and 
provide an opportunity for notice and 
comment. 

Besponse: We have said that we plan 
to provide notice of imposition of a 
temporary enrollment moratorium in 
the Federal Register, explaining the 
rationale for the imposition. We will not 
be providing an opportunity for 
comment prior to the imposition of a 
temporary enrollment moratorium, 
because it is not a rulemaking effort, 
Moreover, we think that providing 
advance notice of a temporary 


enrollment moratorium mi^t foster a 
spike in enrollment applications ftom 
providers or suppliers that would be 
subject to the moratorium. If we 
determine that a temporary enrollment 
moratorium is needed, we would not 
want to provide opportunities for 
providers and suppliers to circumvent 
the moratorium’s purpose. 

Comment: A commenter 
recommended that CMS impose a 
temporary moratorium nationally on 
any Medicare-certified HHAs. As an 
alternative, the commenter su^ested a 
moratorium in any State without either 
HHA licensure or a certificate of need, 
or in any State where the growth in new 
HHAs in the most recent 4 years has 
exceeded 15 percent. 

Response: At this time, we are not 
contemplating the imposition of 
national moratoria. Moreover, it would 
be premature to identify any provider or 
supplier type that might be subject to 
imposition of a temporary enrollment 
moratorium. Should it be necessary to 
impose a temporary enrollment 
moratorium on any provider or supplier 
type, we will explain the reasons for the 
temporary enrollment moratorium in a 
public, notice in the Federal Register. 

Comment: One commenter stated that 
while they are in agreement with the 
proposal that State Medicaid agencies 
should have the authority to impose 
temporary moratoria on the enrollment 
of new providers or impose numerical 
caps or other limits on the providers 
assigned to the high screening level by 
the Secretary, the State Medicaid agency 
should also be allowed the discretion to 
identify providers that are high risk by 
State standards. 

Response: We agree that the State 
Medicaid agency has the discretion to 
identify providers that are high risk by 
State standards. However, section 
1902(kk)(4)(B) of the Act explicitly 
states that the designation of “high risk” 
providers for purposes of this provision 
must be made by the Secretary. Thus, 
we are ftnalizing the requirement that 
when a State Medicaid agency identifies 
a category of providers that are high risk 
of fraud, waste or abuse by State 
standards, the State must seek our 
concurrence with that assignment prior 
to imposing any type of moratoria, 
numerical caps or other limits on the 
enrollment of these providers. 

Comment; One commenter requested 
that the rule be clarified to allow a State 
to complete any provider enrollment 
initiated prior to a Federally imposed 
moratorium. 

Response.'Ifa moratorium is deemed 
necessary, then we believe that all 
unenrolled providers should be subject 
to the moratorium. However, we woiild 


not require the State to deny any 
enrollment for which the State has 
completed its review of the enrollment 
application and has made a 
determination that the provider meets 
all requirements for enrollment. 

Comment: A few commenters 
requested additional information 
regarding the process that should be 
used by State Medicaid agencies to 
notify CMS that imposition of a 
temporary moratorium would adversely 
impact beneficiaries’ access to medical 
assistance, including the documentation 
that will be required and the standards 
CMS will use for its review. 

Response: We believe that additional 
information regarding the operational 
processes that should be used by States 
regarding temporary moratorium are 
more appropriately addressed in 
subregulatory guidance. We will be 
issuing subregulatory guidance to assist 
States with the operational impact of 
implementing this provision in the near 
future. 

Comment: Regarding State 
“identification” of providers with a 
“significant potential for fraud, waste or 
abuse,” one commenter asked that 
documentation of the significant risk be 
required, as well as a description of the 
rationale used to arrive at numerical 
caps or other limits on enrollment of 
that provider type. 

Response: Consistent with section 
1902(kk)(4){B) of the Act. when a State 
Medicaid agency Identifies a category of 
providers that is high risk by State 
standards, the State must seek our 
concurrence with that designation prior 
to imposing any type of moratorium, 
numerical cap or other limit on the 
enrollment of these providers. We will 
expect the State to provide rationale and 
justification for assigning providers to 
the high screening level when seeking 
our concurrence, We will be issuing 
subregulatory guidance to assist States 
with the operational aspect of 
implementing this provision in the near 
future. We agree a temporary enrollment 
moratorium should be imposed only 
with adequate rationale, A temporary 
enrollment moratorium on any category 
of provider that a State identifies as 
posing a significant potential for fraud, 
waste, or abuse, should be supported by 
adequate rationale to justify the 
imposition of a temporary moratorium, 
numerical caps or other limits on 
enrollment of that provider type. 

Comment: One commenter requested 
that CMS add an exception where the 
State has other measures in place that 
adequately control for the potential 
fraud, waste, and abuse that is the basis 
for the proposed moratorium. 
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Response: The ACA does not allow us 
to grant such an exception to States 
even when the State has other fraud 
controls in place. Additionally, we 
believe this additional program integrity 
safeguard is necessary to prevent loss to 
Medicare, Medicaid and CHIP programs 
when existing safeguards have not 
prevented an emergent trend in 
fraudulent, wasteful, or abusive 
practices. We believe the authority to 
impose temporary enrollment 
moratorium when appropriate will be a 
useful tool for both CMS and the States. 

Comment: Several commenters 
requested clarification regarding 
whether this requirement applies to 
Medicaid managed care. These 
commenters specifically asked CMS to 
provide an explicit exception to 
temporary moratoria for Medicaid 
managed care entities so to ensure that 
the adequacy of these plans' provider 
networks is not compromised and in 
turn, impede beneficiary access to care. 

Response: As stated previously, this 
provision does not apply to Medicaid 
managed care entities. Medicaid risk 
based managed care is subject to 
contracts between States and the 
managed care entities, and the States 
rely upon those contracts to ensure that 
Medicaid beneficiaries have access to 
providers and a choice of networks 
within the managed care programs the 
State maintains. We would not impose 
moratoria on managed care programs 
that could restrict the ability of States to 
ensure beneficiary access and choice. 

Comment: One commenter requested 
the development of a process for an 
individual provider exemption from a 
moratorium or, in the alternative, the 
establishment of a more focused process 
for imposing any necessary moratoria. 

Response; As mentioned previously, 
we will take action to impose a 
temporary moratorium only if justified. 
Accordingly, the decision to impose a 
temporary enrollment moratorium will 
be based on the potential risk of fraud, 
waste or abuse in the Medicare or 
Medicaid programs. 

Comment: A commenter stated that 
CMS, should it proceed with this 
proposed rule, must introduce much 
better controls to limit over-reaching 
and to assure providers due process 
rights. The commenter cited CMS’s 
proposed ability to impose a temporary 
enrollment moratorium on potentially 
high risk providers and suppliers wifri 
no rights of judicial review of the 
agency's decision. The commenter 
stated that the absence of defined rights 
for orthotic and prosthetic suppliers in 
the proposed rule could, in some 
instances, appear to be a Federal 
“taking” without due process. 


Response: As stated previously, we 
will provide a discussion of the factors 
for imposing a moratorium on a case by 
case basis when the notice of such a 
moratorium is published in the Federal 
Register. If a provider or supplier's 
billing privileges are denied due to the 
imposition of a temporary enrollment 
moratorium, the denial of billing 
privileges can be challenged 
administratively through the existing 
enrollment appeal procedures at 42 CFR 
part 498. Further, we disagree with the 
commenter's characterization of a 
temporary moratoria of newly-enrolling 
providers and suppliers as a Federal 
“taking.” 

4. Final Temporary Moratoria on 
Enrollment of Medicare Providers and 
Suppliers, Medicaid and CHIP 
Provisions 

This final rule with comment period 
finalizes the provision of the proposed 
rule in regards to the temporary 
enrollment moratoria with the following 
exceptions: 

In §424.570, we modified our 
proposal as follows: 

• Added language to clarify that we 
will fully assess the impact of a 
temporary enrollment moratorium 
would have on beneficiary access to 
services that will be subject to the 
temporary enrollment moratorium at 
§ 424.570(a). 

• Added language that specifies we 
will announce any temporary 
enrollment moratorium in a notice in 
the Federal Register that will include 
the rational for the imposition of the 
moratorium, the particular provider or 
supplier type or the establishment of 
new practice locations of a particular 
type in a particular geographic area at 
§ 424.570(a). 

• Added language to clarify that 
Medicare contractor will deny 
enrollment applications from a provider 
or supplier subject to a moratorium 
specified in paragraph (a) including 
providers and suppliers with pending 
enrollment applications, EXCEPT such 
applications that have been approved by 
the enrollment contractor before the 
imposition of a moratorium at 
§424.530(a)(l0). 

• Added language (hat adopts a 
public commenter’s proposal that the 
Secretary may lift a temporary 
enrollment moratorium in the event of 
a public health emergency in the 
affected geographic area at § 424.570(d). 

• Added language that specifies we 
will publish notice of lifting the 
moratorium in the Federal Register at 
§424.570(d). 


D. Suspension of Payments 
1, Medicare 

a. Background 

In section 6402(h) of the ACA, the 
Congress amended section 1862 of the 
Act by adding a new paragraph (o), 
under which the Secretary may suspend 
payments to a provider or supplier 
pending an investigation of a credible 
allegation of fraud unless the Secretary 
determines that there is good cause not 
to suspend payments. This section 
requires that the Secretary consult with 
the HHS OIG in determining whether 
there is a credible allegation of fraud 
against a provider or supplier. For 
purposes of this Medicare payment 
suspension regulation, we will refer to 
providers and suppliers collectively as 
“providers". 

b. Previous Medicare Regulations 

We have long bean authorized to 
suspend payments in cases of suspected 
fraudulent activity, On December 2, 
1996, we finalized regulations § 405.370 
through § 405,379 that provides for 
suspension of payments to providers for 
several scenarios, including when we 
possess reliable information that fraud 
or willful misrepresentation exists. The 
rule provides that we may suspend 
payments to a provider in whole or in 
part based upon possession of reliable 
information that an overpayment or 
fraud or willful misrepresentation exists 
or that the payments to be made may 
not be correct, although additional 
evidence may be needed for a 
determination. 

The existing rule provides that a 
suspension of payments is limited to 
180 days, unless it meets one of several 
exceptions. A Medicare contractor may 
request a one-time only extension of the 
suspension period for up to 180 
additional days if it is unable to 
complete its examination of the 
information that serves as the basis for 
the suspension. Also, OIG or a law 
enforcement agency may request a one- 
time only extension for up to 180 
additional days to complete its 
investigation in cases of fraud and 
willful misrepresentation. The rule 
provides that these time limits do not 
apply if the case has been referred to 
and l,s being considered by the OIG for 
administrative action, such as civil 
monetary penalties. We may also grant 
an extension beyond the .180 additional 
days if DO) requests that the suspension 
of payments be continued based on the 
ongoing investigation and anticipated 
filing of criminal or civil actions. The 
DOJ extension is limited to the amount 
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of time needed to implement the 
criminal or civil proceedings. 

c. Proposed Medicare Suspension of 
Payments Requirements 

Section 6402Ch) of the ACA requires 
that the Secretary consult with the OIG 
in determining whether there is a 
credible allegation of fraud against a 
provider. If a credible allegation of fraud 
exists, the Secretary may impose a 
suspension of payments pending an 
investigation of the allegations, unless 
the Secretary determines that there is 
good cause not to suspend payments. 

We proposed to revise §405.370 to add 
a definition of what constitutes a 
“credible allegation of fraud,” to include 
an allegation from any source, including 
but not limited to fraud hotline 
complaints, claims data mining, 
patterns identified through provider 
audits, civil False Claims Act, and law 
enforcement investigations. Allegations 
are considered to be credible when they 
have indicia of reliability. Many issues 
related to this definition will need to be 
determined on a case-by-case basis by 
looking at all the factors, circumstances 
and issues at hand, We continue to 
believe that CMS or its contractors must 
review all allegations, facts, and 
information carefully and act 
judiciously on a case-by-case basis 
when contemplating a payment 
suspension, mindful of the impact that 
payment suspension may have upon a 
provider. 

We received the following comments: 

Comment: We received numerous 
comments suggesting that the proposed 
definition of “credible allegation of 
fraud” was ambiguous and fails to detail 
a precise evidentiary standard that CMS 
and OIG will employ in determining if 
a payment suspension is warranted. 
Commentors were also concerned that 
including fraud hotline complaints as a 
source of allegations would inevitably 
lead to disingenumis allegations from 
competitors and/or disgruntled former 
employees that would lead to 
unjustified payment suspensions. 

Response; We did not intend to detail 
a precise evidentiary standard in this 
definition: rather we intended to give 
examples of the typical sources of 
allegations of fraud and explain that 
assessing the reliability of an allegation 
is a process that will occur on a case- 
by-case basis, CMS and OIG fully 
understand the need to act Judiciously 
when corroborating information and 
investigating allegations of fraud, 
especially when the source of the 
allegation is an anonymous fraud 
hotline complaint. The statutorily 
required consultation between CMS and 
the OIG prior to implementing a 


payment suspension will provide ample 
opportunity for the credibility of an 
allegation to be assessed and for a 
preliminaiy investigation info the 
allegation of fraud to occur sufhcient to 
meet a reasonable evidentiary standard. 

We additionally proposed modifying 
the existing §405.370 to add a 
definition for “resolution of an 
investigation.” The ACA provides for 
the suspension of payments pending the 
investigation of a credible allegation of 
fraud, and we believe that this provision 
necessitates defining when an 
investigation has concluded and the 
basis for the suspension of payments no 
longer exists. The definition proposed 
in the proposed rule and finalized here 
is that a resolution of an investigation 
occurs when legal action is terminated 
by settlement, judgment, or dismissal, or 
when the case is closed or dropped 
because of insufficient evidence. We 
solicited comments on an alternativo 
definition of the term “resolution of an 
investigation” which is that it occurs 
when a legal action is initiated or the 
case is closed or dropped because of 
insufficient evidence to support the 
allegations of fraud. We did not receive 
any comments that specifically 
addressed a preference for either of 
these definitions. 

We proposed modifying the existing 
§ 405.371(a) to differentiate between 
suspensions based on either reliable 
information that an overpayment exists 
or that payments to be made may not be 
correct, and suspensions based upon a 
credible allegation of fraud. As required 
by the ACA, we proposed in this section 
that CMS or its contractor must consult 
with the OIG, and as appropriate, the 
Department of Justice (DOJ) in 
determining whether a credible 
allegation of fraud exists prior to 
suspending payments on the basis of 
alleged fraud. 

We also proposed in accordance with 
the ACA that we retain discretion 
regarding whether or not to impose a 
suspension or continue a suspension, as 
there may be good cause not to suspend 
payments or not to continue to suspend 
payments to providers or suppliers in 
certain circumstances. We proposed to 
add a new §405.371(b) to describe 
circumstances that may qualify as good 
cause not to suspend payments or not to 
continue to suspend payments despite 
credible allegations of fraud. 

In paragraph (b)(l}, we proposed a 
good cause exception based upon 
specific requests by law enforcement 
that CMS not suspend payments. There 
are numerous reasons for which law 
enforcement personnel might make such 
a request, including that imposing a 
payment suspension might alert a 


potential perpetrator to an investigation 
at an inopportune or particularly 
sensitive time, jeopardize an undercover 
investigation, or potentially expose 
whistleblowers or confidential sources. 

In paragraph {b)(2), we proposed a 
good cause exception not to suspend 
payments if we determine that 
beneficiary access to necessary items or 
services may be jeopardized. We 
envision there may be scenarios in 
which a payment suspension to a 
provider might jeopardize a provider’s 
ability to continue rendering services to 
Medicare beneficiaries whose access to 
items or services would be so 
Jeopardized as to cause a danger to life 
or health. 

In paragraph (b)(3) of the proposed 
rule, we proposed a good cause 
exception not to suspend payments if 
CMS determines that other available 
remedies implemented by or on behalf 
of CMS more effectively or quickly 
protect Medicare funds than would 
implementing a payment suspension. 
For example, law enforcement 
personnel might request that a court 
immediately enjoin potentially unlawful 
conduct or prevent Ae withdrawal, 
removal, transfer, disposal, or 
dissipation of assets, either or both of 
which might protect Medicare funds 
more fully or quickly than would 
imposition of a payment suspension. 

More generally, in paragraph (b)(4) of 
the proposed rule, we proposed a good 
cause exception based upon a 
determination by us that a payment 
suspension or continuation of a 
payment suspension is not in the best 
interests of the Medicare program. We 
further proposed that we will conduct 
an evaluation of whether there is good 
cause not to continue a suspension 
every 180 days after the initiation of a 
suspension based on credible 
allegations of fraud. We believe that 
circumstances surrounding a specific 
case may change as an investigation 
progresses, and it may become in the 
best of interests of the Medicare 
program to terminate a payment 
suspension prior to the resolution of an 
investigation. As part of this ongoing 
evaluation, we will request a 
certification from the OIG or other law 
enforcement agency as to whether that 
agency continues to investigate the 
matter. 

We considered additional specific 
circumstances and scenarios that may 
qualify as good cause not to continue a 
payment suspension prior to the 
resolution of an investigation, and 
solicited comments on this approach. 
For example, one scenario that we 
considered as additional good cause not 
to continue a suspension is when a 
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suspension has been in place for a 
specific length of time, such as 2 years 
or 3 years, and the investigation has not 
been resolved. We anticipated that on a 
case hy case basis, we would evaluate 
the status of a particular investigation 
and the nature of the alleged fraud in 
determining whether keeping a payment 
suspension in effect beyond a certain 
length of time may not be in the best 
interests of the Medicare program. We 
chose not to propose specific language 
on duration in the regulatory text. 
However, we solicited comment on this 
approach. 

Comment.' Numerous commenters 
supported an additional good cause 
exception not to continue a payment 
suspension when the accompanying 
investigation continued beyond a 
certain length of time. Several 
commenters supported this exception, 
however most believe that 2 years or 3 
years was much too long for a 
suspension to be in effect and the length 
of time associated with this good cause 
exception should be much shorter. 

Response: We agree with the 
commenters who support the additional 
good cause exception not to continue a 
payment suspension when an 
investigation has continued beyond a 
certain length of time, in certain cases. 
We believe that 18 months is the 
appropriate timeframe for a good cause- 
based exception beyond which a 
payment suspension ought not continue 
except under certain limited 
circumstances. Therefore, good cause 
not to continue a payment suspension 
beyond 18 months shall be deemed to 
exist unless one of two specific criteria 
is met. The first of these criteria is if the 
case has been referred to, and is being 
considered by, the OIG for 
administrative action (for example, civil 
money penalties) or such administrative 
action is pending. The second of these 
criteria is if the Department of Justice 
submits a written request to CMS that 
the suspension of payments be 
continued based on the ongoing 
investigation and anticipated filing of 
criminal and/or civil actions or based on 
a pending criminal and/or civil action. 
We are adopting these two law 
enforcement specific scenarios that will 
serve as the criteria for extending a 
payment suspension beyond 18 months 
and are based upon the longstanding 
criteria for extending suspensions found 
in the Medicare payment suspension 
regulations. 

We proposed modifying the existing 
§405.372 to reflect the changes made in 
§405.371 which divides the payment 
suspension authority into situations 
involving overpayments and situations 
involving allegations of fraud. In 


§ 405.372(c) we clarify the subsequent 
action requirements to distinguish 
between, suspensions based on credible 
allegations of fraud and those that are 
based on other factors, such as 
overpayments. For suspensions that are 
not based on credible allegations of 
fraud, CMS and its contractors will 
continue to take timely action to obtain 
additional information needed to make 
an overpayment determination and 
make all reasonable efforts to expedite 
the determination. Once the 
determination is made, notice of the 
determination will be given to the 
provider or supplier and the payment 
suspension will be terminated. If the 
payment suspension is based on 
credible allegations of fraud, CMS and 
its contractors will take subsequent 
action to determine if an overpayment 
exists or if the payments may be made, 
however the termination of the 
suspension and the issuance of a flnal 
determination notice to the provider or 
supplier may be delayed until, 
resolution of the investigation. At the 
end of the fraud investigation, it is 
possible that the Medicare contractor 
will not have completed its 
overpayment determination, but will 
have reliable evidence of an 
overpayment or will have evidence that 
the payments to be made may not be 
correct. This typically occurs when a 
law enforcement investigation results in 
civil or criminal resolution prior to the 
Medicare contractor having had 
sufficient time to complete its 
overpayment determination. In such a 
situation, we would allow the 
suspension to continue as an 
overpayment suspension. 

We proposed modifying the existing 
§ 405.372(d) concerning the duration of 
suspension of payment. In 
§ 405.372(d)(3) we except suspensions 
based on credible allegations of fraud 
from the established time limits 
specified in paragraphs (d)(1) and (d)(2}. 
We believe the strict time constraints 
found in paragraphs (d)(1) and (d)(2} 
should only be applied to suspensions 
based on reliable information of an 
overpayment or where payments to be 
made may not be correct, both of which 
require a speedy overpayment 
determination. When credible 
allegations of fraud are present, we 
believe we should have the flexibility to 
maintain a suspension beyond these 
established time limits in order for an 
investigation to be completed or the 
matter to be resolved. However, we 
noted that by excepting suspensions 
based on credible allegations of fraud 
from these previously established 
timeframes, we do not intend to 


suspend payments to providers and 
suppliers indefinitely. We will be 
actively evaluating the progress of any 
investigation to determine if good cause 
exists to no longer continue the 
suspension of payments, as suspensions 
are designed to be a temporary measure. 
As part of this recurring evaluation, we 
will request a certification from the OIG 
or other law enforcement agency that 
the matter continues to be under 
investigation. 

We also proposed eliminating the two 
other existing scenarios in paragraph 
(d)(3) for extending payment 
suspensions beyond the time limits in 
paragraphs (d)(1) and (d)(2), which are 
when the OIG is considering 
administrative action such as civil 
monetary penalties and also when the 
DO) requests an extension based on an 
ongoing investigation and the 
anticipated filing of criminal and/or 
civil actions. We have removed these 
two scenarios from the existing duration 
provisions in § 405.372(d), however we 
have added similar criteria for 
extending suspensions to the good cause 
criteria at § 405.371 (b)(3), based on 
these law enforcement scenarios. 

Comment: We received numerous 
comments raising concern over the 
perceived lack of due process afforded 
to the provider community in this 
proposed rule and numerous commeuts 
suggesting that more attention needs to 
be paid to establishing clear criteria for 
suspensions and basic due process 
rights before implementing this 
provision. Commenters also pointed out 
that the ACA does' not mandate a 
deadline for implementing this policy 
and commenters recommend we 
withdraw the suspension provision 
from the final rule with comment period 
and work to develop defined standards 
with meaningful due process 
protections. 

Response: We believe that the 
proposed rule affords providers who 
have had their payments suspended 
based on credible allegations of fraud 
ample opportunity to submit 
information to us in the established 
rebuttal statement process to 
demonstrate their case for why a 
suspension is unjustified. We believe 
that the criteria for suspension of 
payments are clear. We reiterate that 
this authority will be exercised 
judiciously by CMS, in consultation 
with the OIG, and that only in the most 
egregious cases will payment 
suspensions last longer than the 
previously established timeframes for 
payment suspensions. We will not 
withdraw the suspension provision 
from the final rule with comment period 
as we believe the due process 
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protections are more than adequate and 
the evidentiary standards for payment 
suspensions cannot be more precisely 
defined. 

Comment: A commenter suggested 
that the proposed rule lacks specificity 
around Ae required consultation 
between CMS and the OIG and the DOJ 
and asked which entity ultimately 
decides whether an allegation is 
credible and whether a unanimous 
determination is required. 

Response: We retain the ultimate 
authority regarding whether or not a 
payment suspension will be 
implemented in a given case. The 
mechanics of the consultation between 
CMS and our law enforcement partners 
to determine the credibility of 
allegations will be detailed in a 
Memorandum of Understanding 
between the respective agencies and we 
do not believe it is appropriate to detail 
this process in the final rule with 
comment period. 

Comment; A commenter questions 
why there is no defined time 
requirement for CMS to provide written 
notice of a suspension that was imposed 
without prior notice, similar to the time 
limits required of States in the Medicaid 
payment suspension rule. 

Response; The Medicare and 
Medicaid payment suspension rules 
need not mirror each other in every 
respect. We have long suspended 
payments without prior notice to 
providers in cases of suspected fraud 
and have an established track record for 
providing written notice to providers as 
soon as is practicable after 
implementing a suspension. We do not 
believe it is necessary to impose a 
strictly defined time period for 
providing notice to providers who were 
suspended without prior notice based 
on credible allegations of fraud, and we 
do not believe that a 30, 60, or 90 day 
limit is necessary as in nearly all 
historical cases we have provided notice 
to providers well within these suggested 
time limits. 

Comment: One commenter expressed 
concern over CMS treatment of payment 
suspensions in the cases of 
overpayments without credible 
allegations of fraud and pointed out that 
there are a multitude of scenarios under 
which physicians might be overpaid 
due to inadvertent hilling errors or 
Medicare contractor claims processing 
errors that are no fault of the provider. 

Response: We believe that we must 
retain the ability to suspend payments 
in both cases of potential fraud and 
cases that do not involve potential fraud 
but are based solely on potential 
overpayments. We have long had the 
authority to suspend payments without 


evidence of fraud but historically have 
not often, used the suspension tool in 
these cases. We will determine on a 
case-by-case basis whether a suspension 
of payments is appropriate in cases that 
do not involve fraud, and factors such 
as Medicare contractor claims 
processing errors and provider billing 
history are certainly considered. 

Comment: One commenter requested 
that CMS provide clarification on 
whether the proposed rule's suspension 
provisions apply to the Medicare Part D 
program and suggested that the 
proposed rule seems to conflict with 
legislation and CMS promulgated rules 
regarding prompt payment of Medicare 
Part D claims. 

Response; The Medicare payment 
suspension authority is applicable to 
providers under both the Part A and 
Part B programs. Separate authorities 
are available to address potential fraud 
by plans participating in the Part C and 
D programs. 

Comment. • One commenter believes 
that Federally Qualified Health Centers 
(FQHCs) should be exempted from the 
potential application of the suspension 
of payments because payment to FQHCs 
is premised on reimbursement of 
reasonable costs and FQHCs are subject 
to an annual reconciliation process 
under which surplus payments in 
excess of reasonable Medicare costs are 
returned to the CMS contractor. 

Response; All providers in Medicare 
Part A and Part B are subject to the 
payment suspension provisions, 
regardless of the method of 
reimbursement. The annual 
reconciliation process under which 
surplus payments are returned does not 
necessarily account for credible 
allegations of fraud and we reserve the 
right to impose a payment suspension 
on any provider for whom there is a 
credible allegation of fraud. 

We are adopting the provisions of the 
proposed rule, with one exception, in 
§ 405.37l(b)(3l, we state that good cause 
shall be deemed to exist to not continue 
to suspend pa)mients if a payment 
suspension has been in effect for a 
period of 18 months unless certain 
conditions are met. 

2. Medicaid 
a. Background 

In section 640Z{h) of the ACA, the 
Congress amended section 1903{iK2) of 
the Act to provide that Federal 
Financial Participation (FFP) in the 
Medicaid program shall not be made 
with respect to any amount expended 
for items or services (other than an 
emergency item or service, not 
including items or services furnished in 


an emergency room of a hospital) 
furnished by an individual or entity to 
whom a State has failed to suspend 
payments under the plan during any 
period when there is pending an 
investigation of a credible allegation of 
fraud against the individual or entity as 
determined by the State in accordance 
with these regulations, unless the State 
determines in accordance with these 
regulations that good cause exists not to 
suspend such payments. 

b. Previous Medicaid Regulations 

State Medicaid agencies have long 
been authorized to withhold payments 
in cases of fraud or willful 
misrepresentation. On December 28, 
1987, DHHS finalized regulations at 
§ 455.23 that they described as 
specifically encouraging State Medicaid 
agencies to withhold program payments 
to providers without first granting 
administrative review where the State 
agency has reliable evidence of 
fraudulent activity by the provider, The 
regulations were issued by the HHS OIG 
based on a concern that State 
administrative hearings could interfere 
with investigations conducted by HHS 
OIG's Office of Investigations or by the 
State’s Medicaid fraud control unit 
(MFCU). The requirements of an 
administrative hearing could jeopardize 
criminal cases and investigators were 
reluctant to agree to a State’s 
withholding payment, thus risking 
additional overpayments. {Seethe 
December 28. 1987 final rule (52 FR 
48814)). The December 28, 1987 final 
rule remains in effect and has remained 
unchanged since it was promulgated. 

At the time the rule was proposed, the 
Department was in the process of 
reorganizing its fraud and abuse 
regulations to reflect authorities 
transferred to HHS OIG in 1983, as well 
as those retained by CMS. HHS OIG 
authorities were transferred to a new 42 
CFR chapter V, while CMS’ Medicaid 
program integrity authorities were 
retained at 42 CFR part 455. (See the 
September 30, 1986 final rule (51 FR 
34764)), 

This current rule provides that a State 
Medicaid agency may withhold 
payments to a provider in whole or in 
part based upon receipt of reliable 
evidence that the need for withholding 
payments involves fraud or willful 
misrepresentation under the Medicaid 
program. At the time this rule was 
published, commenters questioned what 
constituted “reliable evidence of fraud.” 
The HHS OIG declined to provide a 
specific definition, noting that what 
constitutes “reliable evidence” is not 
easily and readily definable. The HHS 
OIG noted that while the existence of an 
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ongoing criminal or civil investigation 
against a provider may be a factor in 
determining whether reliable evidence 
exists, that reliable evidence should bo 
determined on a case-by-case basis with 
the State agency looking at all the 
factors, circumstances, and issues at 
hand, and acting judiciously on this 
information. 

The 1987 regulations also permitted 
payments to be suspended in whole or 
in part, Commenters had suggested that 
“clean claims” continue to be processed 
without delay, and that any withholding 
ought to be targeted to only the type of 
Medicaid claims under investigation. 
The HHS OIG responded that it is 
usually difficult to determine which 
claims are “clean” until after an 
investigation has been completed, but 
noted that where an investigation is 
solely and definitively centered upon a 
specific type of claim that a State could, 
at its discretion, withhold payments on 
just those types of claims. The HHS OIG 
also agreed to commenters’ requests to 
clarify that the withholding provisions 
apply only to alleged fraud or willful 
misrepresentation related to improperly 
received Medicaid payments and not to 
ancillary unrelated matters such as 
deceptive advertising, 
c. Proposed Medicaid Suspension of 
Payments Requirements 

The current regulation at § 455.23 
formed the framework for these final 
regulations. State Medicaid agencies 
have long had the authority to withhold 
payments in cases of alleged fraud or 
willful misrepresentation. Section 
6402(h)(2) of the ACA now mandates 
that States not receive FFP in cases 
where they fail to suspend Medicaid 
payments during any period when there 
is pending an investigation of a credible 
allegation of fraud against an individual 
or entity as determined by the State in 
accordance with these proposed 
regulations unless the State determines 
that good cause exists for a State not to 
suspend such payments. To conform the 
existing regulation to the terminology of 
the ACA, we proposed to change the 
phrase “withhold payments” to 
“suspend payments,” a change we 
believe is merely semantic. 

We proposed to implement section 
6402(h)(2) of the ACA by modifying the 
existing § 455.23(a) to make payment 
suspensions mandatory where an 
investigation of a credible allegation of 
fraud under the Medicaid program 
exists. Based on the ACA’s use of just 
the term “fraud,” we did not propose to 
retain the existing term “willful 
misrepresentation.” We believe that 
fraud encompasses willful 
misrepresentation as well as other acts 


that may constitute civil or criminal 
fraud; thus we do not believe this 
proposal represents a substantive 
change nor do we intend it to have a 
substantive effect insofar as reducing of 
limiting a State’s authority to suspend 
Medicaid payments. We solicited 
comments on this approach. 

To conform the proposed regulation 
to the requirements of the ACA, we 
proposed to modify terminology in the 
existing § 455.23(a) that now refers to 
“receipt of reliable evidence” to instead 
refer to a “pending investigation of a 
credible allegation of fraud.” In contrast 
to the semantic change from “withhold 
payments” to “suspend payments,” in 
this case we believe that there is a 
substantive difference between the 
threshold level of certainty or proof 
necessary to identify a “credible 
allegation” versus the heightened 
requirement of “reliable evidence” in the 
current regulation. 

We do not believe that the phrase 
“when there is pending an investigation 
of a credible allegation of fraud” 
necessarily demands that an 
investigation originate in or with a law 
enforcement agency. Rather, State 
Medicaid agencies have program 
integrity units that, in the normal course 
of business, receive, and conduct 
investigations based upon, tips alleging 
fraud, and which also conduct proactive 
investigations based upon internal data 
analyses and other fraud detection 
techniques. We believe that State agency 
investigations, though they may be 
preliminary in the sense that they lead 
to a referral to a law enforcement agency 
for continued investigation, are 
adequate vehicles by which it may be 
determined that a credible allegation of 
fraud exists sufficient to trigger a 
payment suspension to protect 
Medicaid hinds. 

This threshold by which a State 
Qgoncy investigation may give rise to a 
payment suspension is a somewhat 
ies.<ier threshold than that in the current 
regulation. The preamble to the current 
regulation specified that it was 
anticipated the State agency would 
confer with, and receive the 
concurrence of, investigative or 
prosecuting authorities prior to 
imposing a williholding action. 
However, that preamble also stated that 
it was establishing mere minimum 
requirements, and that States could 
exercise broader power where State law 
or regulation so provided. Most States 
have availed themselves of the existing 
Federal authority (or broader state 
authority) to withhold payments, and 
we believe that experience over the past 
20 years offers no indication this 
authority has been misused against 


providers. Moreover, we believe this 
proposed threshold is consistent with 
the phrase “pending investigation of a 
credible allegation of fraud” of the ACA. 
We do anticipate that payment 
suspension authority will be used more 
frequently because the ACA dictates 
that where there is a pending 
investigation of credible allegations of 
fraud against a provider, a State that 
fails to suspend payments to that 
provider will not receive FFP with 
respect to such payments unless good 
cause exists not to suspend them. 

We proposed to adopt at § 455.2 the 
same broad definition of “credible 
allegation” proposed previously in the 
context of the Medicare program. In 
many cases, what constitutes a “credible 
allegation” must be determined on a 
case-by-case basis with the State agency 
looking at all the factors, circumstances, 
and issues at hand. Guided by the 
experience of more than 20 years, we 
are aware that States have been able to 
identify “reliable evidence” through a 
variety of means including, but not 
limited to, fraud hotline complaints, 
Medicaid claims data mining, and 
patterns identified through provider 
audits, along with the appropriate level 
of additional investigation that 
accompanies each of these. Moreover, 
States have received referrals from State 
MFCUs, other law enforcement 
agencies, and other State benefits 
program investigative units. We 
continue to believe that State agencies 
must review all allegations, facts, and 
evidence carefully and act judiciously 
on a case-by-case basis when 
contemplating a payment suspension, 
mindful of the impact that payment 
suspension may have upon a provider. 

We proposed at § 455.23(b) that the 
State agency notify a provider of a 
payment suspension in a way very 
similar to the mechanism currently 
specified in regulation, by which the 
State agency is required to notify a 
provider, specifying certain details, 
within 5 days of taking such action. 
However, we did propose to provide for 
a 30-day period, renewable in writing 
up to twice for a total not to exceed 90 
days, by which law enforcement may, in 
writing, request the State agency to 
delay notification to a provider. We 
proposed this because we believe that 
occasionally an investigation may be at 
a sensitive stage, perhaps involving 
undercover personnel or a confidential 
informant, where required notification 
to the provider at a particular time 
might jeopardize the investigation. We 
do not believe we should extend the 
delay notification beyond 90 days out of 
fairness to a provider and, in any event, 
a provider deriving any significant 
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revenue stream from Medicaid is likely 
to itself discern the fact of a payment 
suspension well in advance of 90 days. 

We proposed only minor changes to 
the current provisions in § 455.23(c) on 
the duration of a suspension. To 
comport with the ACA, we change the 
term “withholding” to “suspension”: this 
is a semantic change that, as noted 
previously, has been made throughout. 
In the new § 455.23(c)(2), we propose to 
require a State to notify a provider of the 
termination of a payment suspension 
and, where applicable, to specify the 
availability to a provider of any appeal 
rights under State law and regulation. 

Substantively, we did not propose 
significant change to the existing 
duration provisions, which specify that 
withholding (now, suspension) will be 
temporary and will not continue after; 

(l) Authorities discern that there is 
insufficient evidence of fraud upon 
which to base a legal action; or (2) legal 
proceedings related to the alleged fraud 
are completed. 

We believe that maintaining the 
existing duration provisions is 
consistent with the ACA that requires 
that FFP not be made w'hen a State fails 
to suspend payments “during any period 
when there is pending an investigation 
of a credible allegation of fraud against 
an individual or entity.” We further 
recognized that the Act applies a very 
similar standard to the Medicare 
program. We solicited comments on our 
proposal to maintain the existing 
duration provisions. 

In § 455. 23(d) of the proposed rule, 
we proposed to require a State to make 
a formal, written suspected fraud 
referral to its MFCU or, where a State 
does not have a MFCU to an appropriate 
law enforcement agency, for each 
instance of payment suspension as the 
result of a State agency’s preliminary 
investigation of a credible allegation of 
fraud. This will ensure that an 
appropriate full investigation by a law 
enforcement agency timely ensues. If 
the MFCU or other law enforcement 
agency declines to accept the referral, 
we proposed to require the State to 
immediately release the payment 
suspension unless the State refers the 
matter to another law enforcement 
entity or unless the State has alternative 
Federal or State authority hy which it 
may impose a suspension. In the latter 
case, the requirements of that alternative 
authority, including any notice and due 
process or other safeguards, will be 
applicable. 

We proposed to require that a State’s 
formal, written suspected fraud referral 
meets fraud referral performance 
standards issued by the Secretary. The 
currently applicable fraud referral 


performance standards were Issued by 
CMS on September 30, 2008. 

In § 455.23(d)(3), we proposed that on 
a quarterly basis a State must request a 
certifrcation from the MFCU or other 
law enforcement agency that any matter 
accepted on the basis of a referral 
continues to be under investigation or in 
the course of enforcement proceedings 
warranting continuation of the payment 
suspension. We recognized that due to 
various constraints, law enforcement 
agencies may not be able to provide 
specific updates on matters under 
investigation. In recognition of the fact 
that payment suspensions are only 
temporary, however, we proposed to 
require such quarterly certifications to 
ensure, for example, that a suspension 
will not be continued long after a law 
enforcement agency has closed an 
investigation but neglected to alert a 
State agency of that fact. To maximize 
State flexibility to implement this 
requirement, we are not prescribing the 
precise format such certifications must 
take. 

Consistent with the new ACA 
provision, we also proposed to create 
several “good cause” exceptions by 
which States may determine good cause 
exists not to suspend payments or to 
suspend payments only in part. In new 
§ 455.23(e) we included several 
circumstances that we believe constitute 
“good cause” for a State to determine not 
to suspend payments, or not to continue 
a payment suspension previously 
imposed, to an individual or entity 
despite a pending investigation of a 
creaible allegation of fraud. In 
§ 455.23(e)(1), we proposed a good 
cause exception based upon specific 
requests by law enforcement that State 
officials not suspend (or continue to 
suspend) payment. There are numerous 
reasons for which law enforcement 
personnel might make such a request, 
including that imposing a payment 
suspension might alert a potential 
perpetrator to an investigation at an 
inopportune or particularly sensitive 
time, jeopardize an undercover 
investigation, or potentially expose 
whistleblowers or confidential sources. 

In § 455.23(e)(2). we proposed a good 
cause exception if a State determines 
that other available remedies 
implemented by the State could more 
effectively or quickly protect Medicaid 
funds than would implementing (or 
continuing) a payment suspension. For 
example, law enforcement personnel 
might request that a court immediately 
enjoin potentially unlawful conduct or 
prevent the withdrawal, removal, 
transfer, disposal, or dissipation of 
assets, either or both of wfcch might 
protect Medicaid funds more fully or 


quickly than would imposition of a 
payment suspension. 

Paragraph (e)(3) proposed a good 
cause exception based upon a 
determination by the State agency that 
a payment suspension is not in the best 
interests of the Medicaid program. It is 
conceivable that a State may, in rare 
situations, face exigent circumstances 
with respect to a suspension situation 
not addressed by the other good cause 
exceptions specified here but where it 
otherwise determines suspension would 
not be in the State Medicaid program’s 
best interests. This broad standard is 
intended to reflect that payment 
suspension is a very serious action that 
can potentially lead to dire 
consequences, but that it is impossible 
to specify detailed contingencies with 
respect to every possible scenario that 
might arise. We did not anticipate that 
States will frequently make use of this 
exception: however where this 
exception is utilized we do require that 
States document their use of this 
exception, and will closely monitor its 
implementation to determine whether 
further regulation is necessary. We 
solicited comments on this approach. 

In paragraph (e)(4), we proposed a 
good cause exception based upon a 
determination by the State of an adverse 
effect of the suspension on beneficiary 
access to necessary items or services, 

We envision there may be scenarios in 
which a payment suspension to a 
provider might jeopardize a provider's 
ability to continue rendering services to 
Medicaid beneficiaries, thus threatening 
Medicaid beneficiaries' access to care. 
Utilizing a standard identical to that 
which CMS and the HHS OIG apply in 
assessing requests for waivers of 
exclusion at Parts 402 and 1001 of Title 
42, for example, we posit one basis for 
a good cause exception from payment 
suspension is if a provider under 
investigation is a sole community 
physician or the sole source of 
specialized services available in a 
community, Likewise, in Federally- 
designated medically underserved areas 
the potential impact of a payment 
suspension upon a large provider might 
equally threaten recipient access, thus 
this underlies a second acce.ss 
exception, We welcomed comments on 
this approach, including comments with 
respect to other metrics by which to 
assess potential beneficiary jeopardy in 
terms of access to necessary items or 
services. 

Finally, in paragraph {e)(5) we 
proposed a good cause exception that 
would permit (but not require) a State 
to discontinue an existing suspension to 
the extent law enforcement declines to 
cooperate in certifying under the 
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requirements of paragraph (d)(3) that a 
matter continues to be under 
investigation and therefore warrants 
continuing the suspension. 

We do not interpret the new provision 
in the ACA as mandating that a State 
must always suspend all payments to a 
provider in cases of an investigation of 
a credible allegation of fraud. In general, 
we continue to believe a payment 
suspension should apply to all of a 
provider’s claims consistent with the 
HHS OlG’s responses to comments in 
the 1987 regulations that it is usually 
difficult to determine which claims are 
clean claims until after an investigation 
is completed, and one purpose of 
payment suspension is to build a type 
of escrow account out of which any 
overpayments can be deducted when an 
investigation is concluded. 

With certain new constraints, 
however, we have chosen to continue to 
allow States the flexibility to suspend 
payments in part. For example, as stated 
in the preamble to the current 
regulation, there may be times where an 
investigation is solely and definitively 
centered on only a specific type of claim 
in which case a State may determine it 
is appropriate to impose a payment 
suspension on only that type of claim. 
Likewise, a State might determine that 
an investigation of a credible allegation 
of fraud is limited to a particular 
business unit or component of a 
provider such that a suspension need 
not apply to certain business units or 
components of a provider. 

Balancing these approaches, we 
proposed to allow States to implement 
a partial payment suspension, or, where 
appropriate, to convert a previously 
imposed full payment suspension to a 
partial payment suspension, if justified 
via a good cause exception. The good 
cause exceptions for partial suspension 
at paragraphs (fKl) and (2) mirror those 
at paragraphs (e)(4) and (3), 
respectively, and allow the State to 
adopt a partial payment suspension 
where suspension in whole would so 
jeopardize a recipient's access to items 
or services as to endanger the recipient’s 
life or health, or where the State deems 
it in the best interests of the Medicaid 
program, At paragraph (f)l3), we 
proposed that a State may avail itself of 
the good cause exception to suspend 
payments only in part if the nature of 
the credible allegation is focused solely 
and definitively on only a specific type 
of claim or arises from only a specific 
bu.siness unit of a provider, and the 
State determines and documents in 
writing that a payment suspension in 
part would effectively ensure that 
potentially fraudulent claims were not 
continuing to be paid. Many such cases 


will still demand suspension in full, but 
this provision, which we anticipate 
States would exercise sparingly, gives 
States flexibility to act otherwise in 
those limited circumstances where 
appropriate. Finally, at paragraph {f)(4), 
we proposed that a State may avail itself 
of the good cause exception to convert 
a payment suspension in whole to one 
only in part to the extent law 
enforcement declines to cooperate in 
certifying under the requirements of 
paragraph (d)(3) that a matter continues 
to be under investigation. We solicited 
comment on these proposed 
approaches. 

We proposed in new paragraph (g) to 
add several reporting and document 
retention guidelines to § 455.23. 
Payment suspension authority is 
critically important to protect Medicaid 
funds, but payment suspension can 
have dire consequences to a provider, 
Payment suspension authority, 
including a State's exercise of a good 
cause exception to otherwise address a 
suspension situation, must be exercised 
responsibly by a State at all stages, from 
the inception to the termination of the 
suspension. Through, among other 
things, our State Program Integrity 
Reviews, we expect to maintain close 
oversight of State utilization of 
suspension authority. However, to be 
clear, we expressly and explicitly do not 
expect State compliance (or 
noncompliance) with these 
documentation or retention provisions 
to give rise to any enforceable right of 
a provider aggrieved by any real or 
perceived failures with respect to these 
requirements to seek any form of redress 
(administratively, judicially, or 
otherwise). 

Under these final reporting and 
retention guidelines, States are required 
to maintain for a minimum of 5 years 
from the date of issuance all materials 
documenting the life cycle of a payment 
suspension that is imposed, including; 
(1) All notices of suspension of payment 
in whole or part; (2) all fraud referrals 
to MFCUs or other law enforcement 
agencies; (3) all quarterly certifications 
by law enforcement that a matter 
continues to be under investigation; and 
(4) all notices documenting the 
termination of a suspension. Likewise, 
we proposed to require Stales to 
maintain for the same period all 
documentation justifying the exercise of 
the good cause exceptions. Finally, we 
proposed to require States to annually 
report to the Secretary information 
regarding the life cycle of each payment 
suspension imposed and any 
determinations to exerciso the good 
cause exceptions not to suspend 
payment, to suspend'payment only in 


part, or to discontinue a payment 
suspension. 

To effectuate section 6402(h)(2) of the 
ACA’s prohibition on expenditure of 
FFP where a State fails to suspend 
payments that should, by virtue of the 
ACA standard and this proposed rule, 
have been suspended, we proposed to 
add a new § 447.90. Paragraph (a) of 
proposed § 447.90 specifies the basis 
and purpose for the new provision, 
while paragraph (b) specifies the general 
rule that FFP would not be available 
with respect to items or services 
furnished by an individual or entity to 
whom the State has failed to suspend 
Medicaid payments during any period 
where there is pending an investigation 
of a credible allegation of fraud against 
the individual or entity except in 
specified circumstances that include 
certain emergency circumstances, or if 
good cause exists as specified at 
§ 455.23(e) or (f). 

As mentioned, we anticipate that 
CMS' enforcement and monitoring of 
these provisions will largely be 
accomplished through measures such as 
State Program Integrity reviews 
conducted by CMS. Such reviews will, 
among other things, evaluate States’ 
complaint intake and investigation 
efforts, and assess whether States have 
an effective process to move matters 
where there are found to be credible 
allegations of fraud to the point where 
they are evaluated for payment 
suspension. However, we do not believe 
it is viable to require States to report 
and document to CMS every instance of 
where any allegation of fraud arises and 
further qualify which ones rise to the 
level of credible allegation. We want to 
foster effective and efficient State 
program integrity efforts with respect to 
which payment suspension is an 
integral component, but we do not want 
to create a system so procedurally 
onerous that it overwhelms a State's 
ability to substantively perform this 
critical work. Nevertheless, we will 
thoroughly investigate and act by. 
among other things, deferring and/or 
disallowing FFP in accordance with 
§430,40 and §430,42, if program 
integrity reviews or other methods of 
ensuring State compliance with 
Medicaid program requirements reveal a 
State is failing to suspend payments (or 
inappropriately applying a good cause 
exception) where pending investigations 
of credible allegations of fraud do exist. 
A State may not claim (on its Form 
CMS-64) FFP for payments that are 
suspended. Any State that does not 
suspend payments, or that suspends 
payments but continues to claim FFP 
with respect to what would have been 
paid had no suspension been in place. 
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puts that FFP at risk. In such cases, we 
would pursue a deferral and/or 
disallowance to reclaim the Federal 
portion of such payment. VVe solicited 
comments on CMS’ proposed oversight 
approach. 

Finally, three provisions were 
proposed to be added to the regulations 
at § 1007.9 that specify the State 
MFCU’s relationship to, and agreement 
with, the State Medicaid agency. These 
proposed revisions were necessary to 
effectuate the proposed reiisions under 
§ 455.23. The regulation.s at 42 CFR part 
1007 are enforced by HHS OIG as part 
of its delegated authority to certify and 
fund the State MFCUs. (See August 15, 
1979 final rule (44 FR 47811). However, 
we are including amendments to part 
1007 here to ensure a comprehensive 
regulatory package that sets forth in one 
location the Department’s 
implementation of the suspension 
provisions of section 6402(h) of the 
ACA, 

The first of these provisions proposes 
to add a new paragraph (e) to § 1007.9 
that specifies that the MFCU may refer 
to the State agency any provider against 
which there is pending an investigation 
of a credible allegation of fraud for 
purposes of payment suspension in 
accord with § 455.23. Allegations of 
potential fraud may first be identified by 
the MFCU rather than by the State 
agency, so this provision merely 
formalizes a path from the MFCU to the 
State agency so a payment suspension 
may be implemented where appropriate. 
This provision also proposed that any 
referral to the State agency for 
consideration of a payment suspension 
be in writing. The written referral need 
not be extensive, but must include 
information adequate to enable the State 
agency to identify the provider and a 
brief explanation of the credible 
allegations forming the grounds for the 
payment suspension, The second 
proposed addition to § 1007.9 proposed 
to add a new paragraph (0 providing 
that any request by the unit to the State 
agency to delay notification of 
suspension to a provider pursuant to the 
provisions of the proposed 
§ 455.23(b)(l)(ii) come in writing. 
Requiring that such requests be made in 
writing (which could take the form of an 
email) provides for an audit trail to 
ensure that proper procedures are 
followed. However, we expressly do not 
intend for this requirement to create any 
substantive right upon which a provider 
might lodge objection or other legal 
challenge to the extent the proper 
procedures were not followed. Last, a 
new paragraph (g) was proposed to 
require the unit to notify the State 
agency in writing when it has accepted 


or declined a case referred by the State 
agency. Aside firom also creating an 
audit trail, this proposed provision is 
important in that it would alert the State 
agency as to the status of a referral, 
which would shape how the State 
agency would handle a suspension 
under the proposed revisions to 
§455.23. 

We received the following comments: 

Comment; Several commenters 
expressed concern regarding the 
definition of “credible allegation of 
fraud.” Specifically, several commenters 
requested that CMS provide an exact 
definition of “credible allegation of 
fraud” as well as specific standards and 
guidelines for providers to follow to 
make a determination regarding what is 
a credible allegation of fraud. One 
commenter suggested removing the 
word “fraud” from the term. Other 
commenters indicated that the 
definition of what is credible or reliable 
under the proposed rule is circular, that 
is, an allegation is credible if it has 
“indicia of reliability.” In addition, 
several commenters have suggested that 
the new evidentiary threshold is too 
low. 

Response; The term “credible 
allegation of fraud” is a statutory term as 
reflected in section 6402(h) of the ACA. 
Accordingly, we do not have the 
authority to change the term. We have 
considered these comments but decline 
to provide a more exact definition, 
recognizing that different States may 
have different considerations in 
determining what may be a “credible 
allegation of fraud.” Accordingly, we 
believe that States should have the 
flexibility to determine what constitutes 
a “credible allegation of fraud” 
consistent with individual State law. 

We will neither seek to limit what States 
may determine qualifies as a “credible 
allegation of fraud” nor will we require 
States to consult with HHS in making 
such a determination. 

Comment; One commenter suggested 
that CMS should update its policies and 
procedures and develop consistent and 
standard guidance to State Medicaid 
programs regarding the determination of 
credible allegations of fraud. 

Response: We will review our current 
policies and procedures in light of the 
regulatory changes contained in this 
rule, and will provide updated guidance 
to States as necessary. 

Comment: Several commenters 
expressed concern that the evidentiary 
standard is too low and urged CMS to 
retain the current standard, by which 
they suggested defining a “credible 
allegation of fraud” as “reliable 
information that fraud or willful 
misrepresentation exists” as a 


component of the basis for suspension 
of payments under § 455.23(a). 

Response; In the proposed rule, we 
acknowledged that the proposed 
threshold for triggering a payment 
suspension is lower than what is 
contemplated in current regulations, but 
we also indicated that we believe this 
result is dictated by the ACA. However, 
in this final rule with comment period, 
we are amending the definition of 
“credible allegation of fraud” at § 455.2, 
which in the proposed rule read, in 
pertinent part, “[alllegations are 
considered to be credible when they 
have indicia of reliability” to include the 
following; “and the State Medicaid 
agency has reviewed all allegations, 
facts, and evidence carefully and acts 
judiciously on a case-by-case basis.” Due 
to use of just the word “fraud” in section 
6402(h)(2) of the ACA, we proposed to 
remove the term “willful 
misrepresentation” from existing 
regulation, though as we noted in the 
proposed rule, we take the position that 
“fraud” includes "willful 
misrepresentation.” 

Comment: A few commenters 
suggested that the final regulation 
should include a requirement and a 
discussion to provide technical 
guidance to State Medicaid programs 
that clarifies the term “fraud” as a legal 
term and one that carries evidence of a 
willful intent to deceive. 

Response; The definition of fraud, for 
purposes of Medicaid program integrity, 
is reflected in existing regulations at 
§455.2 and reads as follows: “an 
intentional deception or 
misrepresentation made by a person 
with knowledge that the deception 
could result in some unauthorized 
benefit to himself or some other person. 
It includes any act that constitutes fraud 
under applicable Federal or State law,” 
Medicaid fraud is addressed through, 
for example, civil remedies imposed 
under Federal and State false claims 
acts, as well as through criminal 
prosecutions. 

Comment; Numerous commenters 
expressed concerns regarding the list of 
potential sources of credible allegations 
of fraud. Specifically, several 
commenters expressed concern about 
false reports of fraud that may be 
generated by competitors or disgruntled 
employees. In addition, there were 
numerous comments that expressed 
concern over allegations received 
through a fraud hotline and whether 
such allegations could be considered to 
be reliable. Another commenter 
suggested that anonymous hotlines 
should refer to State-operated Medicaid 
fraud hotlines as well as specify to 



256 


5936 Federal Register/ Vol. 76, No. 22 /Wednesday, February 2, 2011/Rules and Regulations 


whom or what entity the fraud hotline 
complaints are being made. 

Response: First, we will not seek to 
limit the potential sources from which 
States may derive credible allegations of 
fraud, We provided examples of sources 
for States to consider and will clarify in 
the final regulation that we are not 
limiting such sources. We recognize that 
credible allegations may come from a 
variety of sources. Second, with respect 
to identifying fraud hotlines as a 
potential source of a credible allegation 
of fraud, we recognize that there may be 
irrelevant or false reports made through 
hotlines, Due to the potential for not just 
false allegations, but also the equal 
possibility of honest mistakes and the 
like, we encourage States to not solely 
rely on a singular allegation without 
considering the total facts and 
circumstances surrounding such 
allegations. In the proposed rule, we 
indicated that States “must review all 
allegations, facts, and evidence carefully 
and act judiciously on a case-by-case 
basis* * As noted previously, we 
are including this language in the final 
rule with comment period in the 
definition of “credible allegation of 
fraud” at § 455.2. We take the position 
that States should have the flexibility to 
determine what they deem to be reliable 
sources for credible allegations of fraud. 
Finally, we will not identify which 
specific fraud hotlines States may use. 
We are aware that there may be a variety 
of hotlines. For example, States may 
have different components within their 
respective agencies that utilize hotlines 
or State law enforcement agencies mav 
also utilize hotlines from which crediGle 
allegations may be generated. 
Accordingly, we will not seek to limit 
the type of hotline States use as sources 
for credible allegations of fraud, 

Comment: Commenters indicated that 
discussions of investigations and 
credible allegations of fraud need to 
defer to State and Federal legal 
definitions of “fraud.” In addition, 
commenters suggested that existing 
Federal regulations indicate that 
investigating fraud is the responsibility 
of State Medicaid Fraud Control Units 
(MFCU). Accordingly, MFCUs should be 
the designated investigators of 
allegations of fraud. 

Response: First, as noted previously, 
“fraud” is defined in existing regulations 
at § 455.2. Second, we disagree that only 
the MFCU may investigate allegations of 
fraud. While MFCUs clearly play a key 
role in investigating and prosecuting 
Medicaid fraud, most, if not all, States 
have program integrity units that, in the 
normal course of business, receive 
hotline and other tips about potential 
fraud, and conduct proactive 


investigations based upon internal data 
analyses and other fraud detection 
techniques. Program integrity units have 
the responsibility under existing Federal 
regulations at §455.14 and 
§ 455.15(a)(1) and the proposed 
regulation at § 455.23(d) of determining 
whether allegations constitute fraud, 
and if they do, referring the matter to 
the MFCU or an appropriate law 
enforcement agency for further 
investigations. Thus, we do not believe 
MFCUs are the sole investigators of 
fraud. 

Comment: Several commenters 
requested that CMS clarify whether a 
finding of billing errors during an audit 
that are not related to allegations of 
fraud would trigger a payment 
suspension. 

Response: Irrespective of the 
circumstances, absent pending 
investigations of credible allegations of 
fraud, payment suspensions would not 
be triggered under these regulations, 
although that does not preclude the 
possibility that a Slate may exercise its 
own broader suspension authority in 
other circumstances. 

Comment; Several commenters 
requested clarification regarding 
whether States should determine the 
credibility of an allegation of fraud prior 
to initiating a suspension action. 

Response: Due to the potential for not 
just false allegations, but also for good 
faith mistakes, misunderstandings, and 
misinterpretations regarding reports of 
alleged fraud as well as data analysis 
errors, we encourage States not to rely 
on any singular allegation or data run 
but rather States should review all 
allegations, facts, and data carefully and 
act judiciously on a case-by-case basis, 
mindful of the potential impact a 
payment suspension may have on a 
provider. 

Comment: One commenter suggested 
that we include the term “abuse” as a 
basis for payment suspension and not 
limit such suspensions to investigations 
of “credible allegations of fraud.” 

Response: We decline to add the term 
“abuse” to Federal regulations in the 
context of payment suspensions, as the 
phrase we have adopted, "credible 
allegation of fraud” has a statutory basis 
reflected in section 640Z(h) of the ACA. 
As a practical matter, however, conduct 
that constitutes abuse as opposed to 
fraud (we note that both terms are 
defined at § 455.2) may be 
indistinguishable not just at the outset 
of an investigation but even through the 
course of an investigation and 
enforcement proceedings and may hinge 
on fine factual distinctions or legal 
points including knowledge and intent, 
and this regulation would not preclude 


the imposition of a suspension in such 
a circumstance so long as there is a 
credible allegation of fraud. Moreover, 
this regulation presents a floor for 
protection of Medicaid funds and does 
not bar a State from setting a higher bar 
allowing for imposition of suspensions 
in other circumstances, 

Comment: One commenter expressed 
concern regarding Federal oversight and 
whether such oversight will amount to 
second-guessing a State’s determination 
of what constitutes a credible allegation 
of fraud. 

Hesponse,’ We do not intend to 
second-guess State determinations 
regarding credible allegations of fraud. 
We intend to work collaboratively with 
States to prevent critical Medicaid 
funds. The purpose of Federal oversight 
is to ensure that States have effective 
processes in place in order to make 
determinations regarding credible 
allegations of fraud. 

Comment: Several commenters 
expressed concern regarding the lack of 
a definition for the phrase “indicia of 
reliability” and requested CMS to 
provide one. 

Hesponse; We have considered the 
concerns of commenters, but decline in 
this final rule with comment period to 
define “indicia of reliability.” We 
recognize the possibility that there may 
be differing standards among States 
with respect to what may be considered 
“indicia of reliability,” but also, as we 
have noted several times in these 
responses, we expect States to gauge the 
credibility of allegations through a lens 
after reviewing all allegations, facts, 
data, and evidence carefully and that 
State action will be exercised 
judiciously on a case-by-case basis. 

Comment.' Several commenters want 
CMS to define “investigation” of a 
credible allegation of fraud. One 
commenter inquired whether a State 
may rely on its MFCU to determine if 
an allegation of fraud is credible. Other 
commenters suggested that the State and 
its investigators are in the best position 
to determine when credible allegations 
of fraud should lead to a payment 
suspension, such that CMS should rely 
on the judgment of these individuals in 
deciding whether to withhold FFP. 
Certain commenters also wanted to 
know if the process of determining 
whether an allegation of fraud is 
credible is sufficient to trigger a 
payment suspension. 

Response; We recognize that the 
process to determine whether an 
allegation of fraud is credible may vary 
among States, and we defer to States — 
applying the principles of careful 
review and judicious action to which 
we refer several times in these responses 
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and which we now include in the final 
rule with comment period — to 
determine whether an allegation or 
complaint rises to the level of a credible 
allegation of fraud. We do not want to 
limit a State’s due diligence process or 
preliminary investigations with respect 
to its assessment of credibility. Nor do 
the proposed regulations specify or limit 
who, or what other agency, may assist 
the State agency with the investigation 
or validation of credible allegations of 
fraud. Nevertheless, if it is determined 
that an allegation is credible, a State 
must still submit a formal written 
referral to its MFCU irrespective of 
whether the MFCU assisted in 
validating an allegation's credibility. 
Finally, the mere fact of an investigation 
to assess the credibility of a fraud 
allegation is insufficient to trigger a 
payment suspension. Rather, a payment 
suspension is triggered when that there 
is, in fact, a pending investigation of a 
credible allegation of fraud. We will 
clarify this in the regulation. 

Coirtment: One commenter suggested 
that the notice of suspension to 
providers should be sent by certified 
mail, set forth the specific {not general) 
allegations and inform the providers of 
the State’.s administrative review 
process and provide appropriate 
citation. Another commenter suggested 
revising the language in §455.23(b)(2){v) 
regarding notice of suspension to 
include information about any 
administrative appeal procedures that 
are available under State law. Other 
commenters suggested that notice be 
furnished to providers prior to the 
implementation of an adverse action 
such as payment suspensions. One 
commenter suggested giving States more 
discretion regarding when notices of 
suspension should be furnished to 
providers. One commenter in particular 
Indicated that bi-weekly remittance 
advisories are issued to providers that 
would, in effect, disclose the State’s 
actions. 

Response: We believe that we should 
afford States the flexibility to determine 
the best method of delivery of notices of 
suspension so we decline to take an 
overly prescriptive approach in this 
regulation. However, we agree that a 
notice of suspension furnished to a 
provider should appropriately reference 
the general allegations upon which a 
suspension is based as well as any 
existing State appeals process. 
Accordingly, we will revise the 
proposed language to reflect the 
inclusion of State administrative appeal 
procedures in the notice of suspension 
to providers. We do not agree that 
providers should be given notice of a 
payment suspension prior to such 


action being taken. We recognize the 
sensitive nature of a fraud investigation 
which may be jeopardized by such 
notice, and expect that State agencies 
will act appropriately so as not to 
jeopardize any investigation. 

Comment: Commenters suggested that 
if a provider or supplier who is subject 
to a payment suspension submits an 
acceptable written rebuttal statement as 
to why the suspension should be 
removed, then this should qualify as 
“good cause” as currently permitted 
under § 405.372(b). In o^er words, a 
rebuttal could establish a good cause 
exception to end a payment suspension. 
Several other commenters suggested 
that in cases of economic hardship, a 
provider should be able to submit 
evidence of this fact for consideration 
by the State in determining whether to 
terminate a payment suspension, and 
requested that CMS create an expedited 
review process. Commenters also 
suggested that the regulations should 
acknowledge the severe financial impact 
of a payment suspension and should 
limit the scope of the suspension to the 
services under review. 

Response: We believe that the 
proposed regulation as written allows a 
State to account for a provider’s rebuttal 
statement. Specifically, as proposed at 
§ 455.23(e), States have the flexibility to 
make a determination that a payment 
suspension is not in the best interests of 
the Medicaid program. States also have 
the option to suspend payments only in 
part if there is good cause. Therefore, we 
do not believe that an additional good 
cause exception is necessary. Moreover, 
as the existing Medicaid suspension has 
for more than 20 years, we continue to 
defer to any State administrative (or 
judicial) review processes, and therefore 
decline to require States to adopt on 
expedited review process. Nevertheless, 
we are including new good cause 
exceptions in this final rule with 
comment period at §455.23(e)(3} and 
(f)(2) to allow a State to terminate a 
whole payment suspension or impose a 
payment suspension only in part if a 
provider furnishes written evidence that 
persuades the State that a payment 
suspension should be terminated or 
imposed only in part. Furthermore, the 
preamble acknowledges and requests 
States to be mindful of the impact that 
suspensions may have upon providers. 

Comment: One commenter inquired 
whether “good cause” is established if 
the items or services are furnished as an 
emergency. 

Response; Section 1903{i)(2) of the 
Act provides for a limited exception for 
payment to be made with respect to 
emergency items or services, though not 
including items or services fiimished in 


the emergency room of a hospital. We 
believe this statutory exception speaks 
for itself and we do hot need to 
otherwise address or expand upon it in 
these regulations. 

Comment: Commenters have 
suggested that the proposed “good 
cause” regulatory provisions should 
include the language contained in the 
preamble acknowledging that “reliable 
evidence should be determined on a 
case-by-case basis with the State agency 
looking at all the factors, circumstances, 
and issues at hand * * * ” (75 pR 
58224). 

Response; We disagree that this 
language belongs in the “good cause” 
regulatory provisions. Instead, we have 
revised the definition of “credible 
allegation of fraud” to reflect that States 
must carefully review ail allegations, 
facts and evidence on a case-by-case 
basis. Accordingly, we do not see the 
need to include this language in the 
“good cause” regulatory provisions, 

Comment; One commenter suggested 
that CMS consider placing the catchall 
of “not in the best interests of the 
Medicaid program” reflected in 
§ 455.23(e)(3) and similarly the catchall 
reflected at subparagraph (f)( 2 ) of 

• payment suspension in part is in 
the best interests of die Medicaid 
program” at the end of the respective 
subparagraphs. 

Response: We agree and will make 
such changes in the final regulation. 

Comment: One of the good cause 
exceptions not to suspend payments to 
Medicaid providers is when “an 
individual or entity is the sole 
community physician or the sole source 
of essential specialized services m a 
community." (emphasis added) One 
commenter suggested replacing “In a 
community” with “for a particular 
beneficiary population." 

Response: We disagree. We are 
concerned about negatively impacting 
beneficiary access to care so this 
exception does not turn on whether a 
provider serves a particular beneficiary 
population, but on whether a 
beneficiary’s access to necessary care is 
impeded. Thus, the good cause 
exception may be applied when a 
beneficiary’s access to care is 
jeopardized because he/she cannot 
obtain necessary services from a 
particular provider type. 

Comment; Several commenters 
questioned whether the requirements of 
this section would apply to Medicaid 
managed care, including whether the 
term “provider” includes managed care 
entities, whether managed care 
capitation payments are included in 
suspensions when an individual 
network provider is under investigation; 
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and what would be the process for 
notifying a managed care entity of a 
credible allegation of fraud. 

Response; The rules governing 
payment suspensions based upon 
pending investigations of credible 
allegations of fraud apply to Medicaid 
managed care entities. If there is a 
pending investigation of a credible 
allegation of fraud against a Medicaid 
managed care organization (MCO), 
prepaid inpatient health plan (PIHP), 
prepaid ambulatory health plan (PAHP), 
or health insuring organization (HIO) at 
the plan level, the State should address 
the issue either through imposing a 
payment suspension or through other 
authorities that may be available to 
them under State law or as part of the 
State’s negotiated agreement with the 
Medicaid MCO, PIHP. PAHP. or HiO. 
The same would hold true for pending 
investigations of credible allegations of 
fraud regarding individual network 
providers, Managed care capitation 
payments maybe included in a 
suspension when an individual network 
provider is under investigation based 
upon credible allegations of fraud, 
depending on the allegations at issue. 
We would expect the process regarding 
the notice of suspension to a Medicaid 
MCO. PIHP. PAHP, or HIO to follow the 
criteria as outlined in this final rule 
with comment period. 

Comment; Some commenters 
requested clarification regarding 
whetlier FFP extends to managed care 
entities' capitation payment. 

Response; FFP extends to Medicaid 
MCOs’, PIHPs’, PAHPs’, and HIOs’ 
capitation payments. Accordingly, if a 
State fails to suspend payments to such 
an entity for which there is a pending 
investigation of a credible allegation of 
fraud, without good cause, FFP may be 
disallowed with regard to such 
payments to the managed care entity. 

Comment: Several commenters 
requested that CMS clarify whether 
interest accrued on suspended 
payments to providers is eligible for 
FFP, 

Response; FFP is not available for 
interest accrued on suspended 
payments to providers. 

Commenf; Commenters asked how 
CMS will notify a Stale that FFT is to 
be suspended as a result of payment to 
an entity for items or services for which 
the State has received a credible 
allegation of fraud. Will the State 
receive advanced notice of the FFP 
suspension and be given the 
opportunity to correct or will the 
suspension be immediate? 

Response; The process for deferring 
and disallowing FFP is governed by 
§ 430.40 and § 430.42, respectively. 


Generally, we take action to defer the 
claim [by excluding the claimed amount 
from the grant award) within 60 days 
after the receipt of a Quarterly 
Statement of Expenditures (prepared in 
accordance with our instructions) that 
includes that claim. The notice of 
deferral to the State is provided by CMS 
within 15 days of such deferral. TTie 
notice should identify the type and 
amount of the deferred claim and 
specify the reason for deferral. The State 
is also requested to make available all 
the documents and materials that CMS 
believes are necessary to determine the 
allow-ability of the claim. However, 
prior to taking action to defer or 
disallow FFP, we may engage States to 
request that impermissible claims for 
FFP are removed from the Quarterly 
Medicaid Statement of Expenditures for 
the Medicaid Assistance Ingram [Form 
CMS-64). 

Comment: One commenter asked, if 
CMS suspends a State's FFP, and the 
allegations of fraud are cleared after the 
fact, what the process will be to restore 

FFP. 

Response; When we determine claims 
associated with deferred or disallowed 
FFP are permissible, we will release the 
deferred or disallowed funds to the 
State by providing FFP for the subject 
claims. 

Comment; One commenter expressed 
concern regarding what the commenter 
saw as a “shift in evaluation of the 
appropriateness of suspensions away 
from the Medicaid agency and entities 
investigating the allegations of fraud to 
the exclusive and unilateral discretion 
of CMS” as well as a broad and 
sweeping increase in CMS’s ability to 
impose a deferral of FFP. 

Response; We have long had the 
authority to withhold FFP and the 
payment suspension rule is not an 
attempt to inappropriately withhold 
FFP from States. Instead, the rule is 
intended to protect precious Medicaid 
dollars from fraudulent providers, an 
effort in which we view the States as 
partners. Generally, we will withhold 
FFP only where a State has 
unreasonably or repeatedly failed to 
suspend payments or otherwise 
terminate a payment suspension where 
there are credible allegations of fraud. 

Comment: One commenter suggested 
that the proposed rule regarding 
suspension of payments to Medicaid 
providers gives Medicaid agencies an 
improper incentive to aggressively deny 
payments to providers or risk losing 

FFP. 

Response: We disagree. As we 
explained in the proposed rule. State 
Medicaid agencies have long had the 
authority to suspend payments to 


providers based upon suspected 
fraudulent conduct. Our goal is to 
ensure that State agencies appropriately 
suspend payments from potentially 
fraudulent providers, in order to protect 
critical Medicaid dollars from falling 
into the hands of such providers. In this 
rule we encourage State agencies to 
suspend payment based upon pending 
investigations of credible allegations of 
fraud only after reviewing ail of the facts 
and circumstances surrounding a 
particular case and making a 
determination that such suspension is 
in fact warranted. 

Comment; One commenter suggested 
that the suspension of payments could 
be interpreted to have retroactive 
application to providers who have 
already been referred to MFCUs or other 
law enforcement agencies; 

Response: We will not require States 
to retroactively apply the law regarding 
suspension of payments based on 
pending investigations of credible 
allegations of fraud, However, upon the 
effective date of this final rule with 
comment period, we expect States: to 
the extent they have not already done 
so, to suspend payments to providers 
against whom there exist pending 
investigations of credible allegations of 
fraud, 

Comment: Commenters have sought 
clarification regarding whether the 
proposed rule applies to individual 
providers who are employed or 
contracted by institutional providers. 

Response: The payment suspension 
rule applies to institutional providers as 
well as enrolled providers who are 
employed or contracted by such 
institutional providers. 

Comment; One commenter wanted 
CMS to clarify whether the “individual 
or entity” under investigation is the 
same “individual or entity” subject to 
the payment suspension. 

Response; Yes, the “individual or 
entity” under investigation is the same 
“individual or entity” that is subject to 
the payment suspension, 

Comment: Several commenters 
expressed concern with States’ 
compliance dales with the Medicaid 
payment suspension rule because some 
States may require State law or 
regulatory changes in order to be able to 
implement the rule. Certain commenters 
also expressed similar concerns that the 
proposed document retention 
requirements exceed time frames 
currently required by their State laws. 

Response: We encourage the State 
Medicaid or program integrity director 
of any State that faces State legislative, 
regulatory, or administrative 
implementation obstacles to contact us 
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in order to work, out a plan of 
resolution. 

Comment: One commenter suggested 
that the process for quarterly reporting 
and certification at § 455.23(d) is 
onerous to the State and the MFCU. The- 
commenter further indicated that 
reporting is already addressed iu 
Memoranda of Understanding between 
the States and the MFCUs, and 
therefore, additional reporting 
requirements would be burdensome on 
the State. 

Response; We disagree, and in the 
proposed rule stated that we would not 
prescribe the format that such 
certifications must take to maximize 
State flexibility. The Memoranda of 
Understanding between the States and 
the MFCUs routinely do not address 
reporting and documentation to the 
degree that will be required by 
§ 455,23{d). Moreover, in the proposed 
rule we emphasized that payment 
suspensions should be temporary and 
we noted the profound impact that a 
payment suspension can have upon a 
provider. We believe that the quarterly 
reporting and certification process is an 
important protection for providers to 
ensure that suspensions do not continue 
after law enforcement has concluded its 
investigation but did not report this 
information to the State Medicaid 
agency. 

Comment; Some commenters 
suggested that documentation and 
record retention in instances regarding 
the decision to not suspend payments is 
expensive and unnecessary given the 
high volume of unfounded ailegations. 
These commenters also suggested that 
the requirement to report summary 
information to the Secretary is 
duplicative given that CMS will be 
reviewing State actions on suspension 
of payment during periodic on-site 
program integrity reviews. 

Response; We disagree. As we 
generally discuss in both these 
responses and in the proposed rule, we 
are balancing a number of interests 
including: (1) A statutory directive from 
the ACA that FFP not be paid in certain 
circumstances; (2) a payment 
suspension provision that, if not 
rigorously and carefully administered, 
can detrimentally impact honest 
providers; and (3) CMS’ intent to 
maintain its appropriate oversight role 
but at the same time not to arbitrarily or 
unreasonably second-gues.s State 
decision-making. As such, we believe 
rigorous documentation requirements 
that go beyond what may he reviewed 
during on-site program integrity reviews 
actually serve to protect everyone’s 
interests. Moreover, we believe it is 
particularly important that States 


carefully document those processes that 
require special judgment calls, such as 
with respect to exercising the various 
good cause exceptions, so that, upon 
CMS review, FFP is not inappropriately 
withheld. 

Comment; One commenter 
recommended that Medicaid State 
agencies should be allowed to share 
potentially helpful information with 
their MFCUs without following the 
requirements in the proposed rule 
regarding documentation and timing of 
the referral of a credible allegation of 
fraud. 

Response; We fully agree with the 
notion that States may share 
information or otherwise consult with 
their MFCUs, recognizing that States 
may need to consult and/or exchange 
information with their respective 
MFCUs prior to making a formal 
referral, and do not seek to limit or 
otherwise define the circumstances by 
which States make such 
communications. We disagree, however, 
with the proposition that States should 
not need to follow our proposed MFCU 
documentation/referral requirements, 
which we believe are important for 
reasons similar to those addressed in the 
previous response, thus we will not 
alter the proposed documentation and 
timing requirements. 

Comment; Certain commenters have 
suggested that it will be cumbersome to 
■require the State to obtain a written 
certification from the MFCU or other 
law enforcement agency that any matter 
that is accepted on the basis of a referral 
continues to be under investigation or in 
the course of enforcement proceedings 
warranting continuation of the payment 
suspension every 90 days. In audition, 
these commenters expressed concern 
that this requirement will result in a 
substantial increase in workload and 
. could result in increased staffing levels. 
Commenters also suggested that existing 
methods of communication regarding 
caseload and referrals between the 
States and the MFCUs should ba 
sufficient. 

Response; We disagree with the 
proposition that the quarterly law 
enforcement certification requirement is 
overly cumbersome or that the 
documentation requirements finalized 
here will result in substantial increases 
in workload. As we have indicated 
previously in these responses and in the 
proposed rule, we believe rigorous 
documentation requirements are in 
everyone’s interest. Moreover, to 
maintain State flexibility, we are not 
prescriptive with respect to the format 
of the quarterly certification. States have 
long had authority to implement 
payment suspensions and, though we 


formalize certain documentation and 
referral requirements here, we believe 
that most State.s that have used 
suspension authority likely have 
rigorous documentation requirements 
already in place to ensure they are able 
to adequately justify suspension actions 
and withstand any provider challenges. 

Comment; With regard to formal fraud 
referrals issued by the State to the 
MFCU or other law enforcement agency, 
one commenter suggested combining 
the relevant NPIs of the affected 
providers into one referral instead of 
referring individual cases. 

Response; This is outside the scope of 
the proposed rule and therefore we will 
not address this issue at this time. 

Comment; One commenter suggested 
that the regulation at § 455.23(g) 
proposing to require States to annually 
report to the Secretary information 
regarding the life cycle of each payment 
suspension imposed and any 
determinations to exercise the good 
cause exceptions not to suspend 
payment, to suspend payment only in 
part, or to discontinue a payment 
suspension, be modified. Specifically, 
the commenter suggested that such 
annual report be filed only if such 
information is shared by law 
enforcement. 

Response; We disagree with the 
commenter’s proposition for two 
reasons. First, a number of the elements 
the commenter points out are not 
contingent on any response from law 
enforcement. Second, we certainly 
appreciate that States can only report on 
the information that is in their 
possession, but believe that annual 
reporting should not be contingent on 
whether law enforcement has snared 
such information. Importantly, to the 
extent that annual reporting reveals gaps 
where law enforcement has neglected or 
refused to share information it will 
illustrate where CMS may have to 
exercise additional oversight authority 
to attempt to close such gaps. Likewise, 
law enforcement’s “failure to 
communicate” may be a significant 
factor in a State’s decision to exercise 
certain of the rule’s good cause 
exception authorities. 

Comment; One commenter suggested 
that CMS include in the final regulation 
at § 455, 23(d)(4), as reflected in the 
preamble to the proposed rule, a 
requirement for States to immediately 
release the payment suspension “unless 
the State has alternative Federal or State 
authority by which it may impose a 
suspension.” (75 FR 58225). The 
proposed regulation does not reflect this 
additional language governing the 
immediate release of a payment 
suspension when MFCU or law 


260 


5940 Federal Register/VoL 76, No. 22/Wednesday, February 2, 2011/Rules and Regulations 


enforcement declines to accept the fraud 
referral, 

Response; We a^ee, and are 
including this language in the final rule 
with comment period. 

Comment; Certain commenters 
suggested revising the proposed 
language to include a 180 day time limit 
for the duration of a suspension of 
payment in the Medicaid program, 
similar to the proposed process under 
Medicare. 

Response; Aside from the general 
constraints and protections built in to 
the rule around the notion that 
suspensions are intended to he 
temporary, we believe that States need 
the flexibility to decide the duration of 
payment suspensions in order to 
accommodate State laws and legal 
processes. Because Medicare Is a 
national program there is more 
uniformity surrounding the disposition 
of Medicare program suspensions. So 
while a specific time limit may he 
adequate there, we believe a more 
flexible approach, nearly identical to the 
approach used with respect to Medicaid 
payment suspensions for more than 20 
years, is necessary to address the needs 
of 50 plus States and territories. 

Comment; One commenter suggested 
that the duration of a payment 
suspension by States should be 
permanent where the provider is later 
convicted of the offense. 

Response; Payment suspensions are 
intended to stem the flow of Medicaid 
dollars to providers against whom there 
are credible allegations of fraud, during 
the pendency of the investigation, 
which includes any related proceedings. 
Separate authorities, some administered 
by other agencies, including possible 
exclusion from participation in Federal 
health care programs, may be 
implemented upon a provider’s 
conviction, 

Comment; One commenter indicated 
that while the proposed rule gives States 
authority to immediately release 
payment suspensions if a timely 
investigation by law enforcement does 
not ensue, that “timely,” is not clearly 
defined. 

Response: We believe that when a 
State learns that law enforcement has 
declined to investigate a fraud referral 
from the State in connection with a 
payment suspension or otherwise 
discontinues a pending investigation, 
the State should immediately take steps 
to terminate a payment suspension. As 
discussed several times in these 
responses, we proposed a requirement 
for States to obtain quarterly 
certifications from law enforcement to 
help address this type of scenario so 
that providers are not subject to a 


continuing payment suspension based 
upon a fraud referral that was declined 
by law enforcement or an investigation 
that has been concluded without the 
State’s knowledge. 

Comment; Certain commenters 
requested clarification regarding the 
resolution of an investigation for 
purposes of terminating a payment 
suspension. 

Response; Generally, a payment 
suspension is temporary and will not 
continue after the State Medicaid 
agency or the prosecuting authorities 
determine that there is insufficient 
evidence of fraud by the provider or 
legal proceedings related to the alleged 
fraud are conmleted. 

Comment; One commenter suggested 
that the proposed rule be changed to 
defer to State law to dictate how long 
and under what circumstances a 
payment suspension can be imposed. 

Response; As we noted in an earlier 
response, this rule presents a floor for 
protection of Medicaid funds and does 
nut bar a State from setting a higher bar 
allowing for imposition of suspensions 
with other conditions or in other 
circumstances. 

Comment: Several commenters 
suggested that the proposed rule does 
not provide adequate due process for 
providers facing suspension of 
payments. Certain commenters also 
suggested that the proposed rule could 
result in a de facto termination from the 
Medicaid program without any 
meaningful duo process. Commenters 
expressed concern that non-fraudulent 
providers may effectively be terminated 
by lengthy suspensions. Commenters 
also suggested shortening the length of 
suspensions or in the alternative, 
maintaining the current permitted 
duration without extension. Another 
commenter indicated that the proposed 
rule does not create a right to challenge 
the ongoing validity of a payment 
su^ension. 

Response; Under the proposed rule, 
providers have an opportunity to submit 
written evidence for consideration by 
the Medicaid agency regarding payment 
suspensions. Based upon this written 
evidence, a State may determine 
whether there is good cause to terminate 
a suspension of payment. Accordingly, 
we believe there are adequate due 
process protections in place pursuant to 
which a provider may establish good 
cause to terminate a payment 
suspension. In addition, this process 
was already accounted for in existing 
Medicaid regulations and we did not 
change the process. We are not aware of 
any issues associated with this process 
which has been in existence for more 
than 20 years. Moreover, we expressed 


in the proposed rule that suspensions, 
because of their significant impact upon 
providers, are only temporary. We 
provided in the rule several protections 
(such as the quarterly law enforcement 
certification and State documentation 
requirements) and also various “good 
cause” exceptions. Moreover, the 
duration of suspension provisions of the 
proposed rule, finalized here, are 
essentially the same as have been in 
place for more than 20 years with the 
existing Medicaid payment suspension 
rule. We believe that the significant 
built-in protections, in conjunction with 
the fact that wa are not aware that the 
current Medicaid suspension process 
has caused significant undue hardship 
with providers having payments 
wrongly suspended, lend adequate 
safeguards to the process. CMS will also 
monitor States’ implementation of the 
Medicaid payment suspension rule 
through the various documentation 
requirements and State program 
integrity reviews, to ensure that there 
are no marked shortcomings with regard 
to States’ processes. 

Comment; One commenter suggested 
that the final regulation should require 
State Medicaid programs to establish 
and codify a Medicaid administrative 
review process with regard to the review 
of payment suspensions. 

Response; We recognize that 
individual State laws vary with regard 
to their respective administrative review 
processes, and believe that most or all 
States have established such processes. 
As previously stated, we will revise the 
proposed language in the regulations to 
reflect the inclusion of State 
administrative appeal procedures in the 
notice of suspension furnished to 
providers. In addition, we believe the 
notice should also include relevant 
citations to State law, where applicable. 

Comment; A couple of commenters 
suggested that CMS develop a system or 
process for exposing and penalizing 
those who make false fraud complaints, 

Response; This is outside the scope of 
the proposed rule and therefore we will 
not consider this suggestion at this time. 

Comment; One commenter requested 
clarification regarding the fraud referral 
standards established by CMS as a result 
of an OIG January 2007 report entitled 
“Suspected Medicaid Fraud Referrals” 
(OEI 07-04-00181), 

Response; We issued fraud referral 
standards on September 30, 2008. The 
link to CMS’ Web site where the fraud 
referral standards may be found is; 
h ttp ://wmv. cms.go v/ 
FraudAbuseforProfs/downhads/fraud 
re/erra/pei/ormancestondordsstate 
agencytoTnfcu.pdf. 
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Comment: One commenter suggested 
that the content of a fraud referral 
should be left to the discretion of each 
State. This commenter suggested that a 
continuing collaborative environment 
will fulfill the regulatory provisions 
regarding content of fraud referrals. 

Response; We encourage States to 
collaborate with their MFCU. A fraud 
referral must contain, at a minimum, the 
elements as outlined in the proposed 
regulation and finalized here, but it is 
within a State’s discretion to the extent 
it wishes to add additional information. 

Comment; One commenter suggested 
that FQHCs should be exempted from 
the application of payment suspensions. 

Response: We disagree. There is no 
statutory requirement to carve out an 
exception for any particular category of 
provider. We believe that payment 
suspensions apply to fraudulent 
conduct regardless of provider type. 

Comment: One commenter suggested 
that payment suspensions should only 
apply to providers in the limited 
screening level, as that terra is defined 
and used in connection with the 
provider screening rules, under only the 
most extraordinary circumstances. 

Response; We decline to carve out an 
exception for providers in the limited 
screening level in the context of a 
payment suspension. This assignment to 
the limited level applies in the context 
of provider screening, not for 
suspension of payments. The 
determination regarding whether to 
imposes payment suspension is driven 
by credible allegations of fraudulent 
conduct and not whether a provider is 
assigned to a certain level for purposes 
of screening. 

CommerU: One commenter requested 
clarification regarding the application of 
payment suspensions to billing 
providers as opposed to prescribing 
providers, Anotner commenter 
requested a guarantee that payment 
suspensions will not be imposed against 
a billing provider. 

Response: We understand that there 
are circumstances in which the 
prescribing provider may be different 
from the furnishing provider and/or 
billing provider, Generally, we believe 
that payment suspension is not the 
appropriate mechanism to recover 
Medicaid funds from one provider who 
inescapably, but innocently, happens to 
be associated with the fraudulent 
conduct of another provider. Because 
payment suspensions only apply based 
upon credible allegations of fraud, 
payment suspensions are generally not 
the appropriate vehicle by which to 
recover reimbursement for items and/or 
services furnished by a provider against 
whom there are no allegations of fraud, 


Nevertheless, there is no guarantee that 
a payment suspension wOl only be 
imposed against the billing provider as, 
particularly at the outset of an 
investigation of a credible allegation of 
fraud, it may be impossible to precisely 
determine the locus of the fraud or 
whether it involved collusion or 
conspiracy. 

Comment; One commenter requested 
clarification regarding whether States 
with authority under existing State law 
may impose suspensions for reasons 
other than where there is a credible 
allegation of fraud. This commenter 
suggested that where such authority 
exists, the requirements proposed under 
§ 455,23, including those concerning 
referrals to the MFCU and the duration 
of suspension should not apply. 

Response: The requirements for 
payment suspensions under the 
proposed rule are based upon credible 
allegations of fraud. As we have noted 
several times in both these responses 
and in the proposed rule, nothing in 
these rules bar a State from exercising 
other broader authorities to suspend 
payments to providers. 

We are adopting the provisions of the 
proposed rule with the exception of the 
following changes: 

• In §455.2, we have revised the 
definition of “credible allegation of 
fraud” to address the issue of the State's 
verification of the allegation. 

• In § 455.23(a)(1), we have added the 
verbiage “after the agency determines 
there is a credible allegation of fraud for 
which” after the term “provider.” 

• In § 455.23(b)(2), we have added a 
new subsection (vi) that reads: “Set forth 
the applicable State administrative 
appeals process and corresponding 
citations to State law.” 

• In §455.23(d]. we have added the 
verbiage “has alternative Federal or 
State authority by which it may impose 
a suspension or” before “makes a fraud 
referral to another law enforcement 
agency.” 

• In § 455.23(e), we have revised 
subsection (3) to state: “The Stale 
determines, based upon the submission 
of written evidence by the individual or 
entity that is the subject of the payment 
suspension, that the suspension should 
be removed.” 

• In §455. 23{e}, we have added a new 
subsection (6) that states: “The State 
determines that payment suspension is 
not in the best interests of the Medicaid 
program.” 

• In §455.23(1). we have revised 
subsection (2) to read: “The State 
determines, based upon the submission 
of written evidence by the individual or 
entity that is the subject of a whole 
payment suspension, that such 


suspension should be imposed only in 
part,” 

• In §455. 23(f), we have added a new 
subsection (5) that states: “The State 
determines that payment suspension 
only in part is in the best interests of the 
Medicaid program.” 

E. Proposed Approach and Solicitation 
of Comments for Sections 8102 and 
640j(a} of the Affordable Care Act 
— Ethics and Compliance Program 

1. Statutory Changes 

Under section 6102 of the ACA which 
established new section 11281 of the 
Act, a nursing facility (NF) or SNF shall 
have in operation a compliance and 
ethics program that is effective in 
preventing and detecting criminal, civil, 
and administrative violations and in 
promoting quality of care, consistent 
with regulations developed by the 
Secretary, working jointly with the HHS 
OIG. The regulations to establish the 
compliance and ethics program for 
operating organizations may include a 
model compliance program, The statute 
requires that in the case of an 
organization that has five or more 
facilities, the formality or specific 
elements of the program vary with the 
size of the organization. The statute also 
requires that not later than 3 years after 
the effective date of the regulations, the 
Secretary shall complete an evaluation 
of the programs to determine if such 
programs led to changes in deficiency 
citations, changes in quality 
performance, or changes in the quality 
of resident care. The Secretary shall 
submit to the Congress a report on such 
evaluation with recommendations for 
changes in the requirements, as the 
Secretary deems appropriate. 

Similarly, under section 6401(a} of the 
ACA, which established a new section 
1866(})(8) of the Act, a provider of 
medical or other items or services or a 
supplier shall, as a condition of 
enrollment in Medicare, Medicaid or 
CHIP, establish a compliance program 
that contains certain “core elements,” 
The statute requires the Secretary, in 
consultation with the HHS OIG, to 
establish the core elements for providers 
or suppliers within a particular industry 
or category. The statute allows the 
Secretary to determine the date that 
providers and suppliers need to 
establish the required core elements as 
a condition of enrollment in Medicare, 
Medicaid, and CHIP, The statute 
requires the Secretary to consider the 
extent to which the adoption of 
compliance programs by providers or 
suppliers is widespread in a particular 
industry sector or particular provider or 
supplier category. Please note, NFs and 
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SNFs are subject to both compliance 
plan requirements under sections 6102 
and 6401(a) since section 6401(a) of the 
ACA includes all providers and 
suppliers enrolling into Medicare. 
Medicaid and CHIP. We intend to 
establish compliance program core 
elements per section 6401 (a) of the ACA 
for NFs and SNFs that closely match the 
required components of a compliance 
program per section 6102 of the ACA. 

2. Proposed Ethics and Compliance 
Program Provisions 

In order to consider the views of 
industry stakeholders, we solicited 
comments on compliance program 
requirements included in the ACA. We 
do not intend to finalize compliance 
plan requirements in this final rule with 
comment period; rather, we intend to do 
further rulemaking on compliance plan 
requirements and will advance specific 
proposals at some point in the future. 
We were most interested in receiving 
comments on the following; 

The use of the seven elements of an 
effective compliance and ethics program 
as described in Chapter 8 of the U.S. 
Federal Sentencing Guidelines Manual 
(http ■J/www. ussc.gOv/2010gujd/ 
20^00503J{eader_FTieT^d]y_P^oposed_ 
Amendments.pdf, pp. 31-35) as the 
basis for the core elements of the 
required compliance programs for 
Medicare, Medicaid and CHIP 
enrollment. These elements instill a 
commitment to prevent, detect and 
correct inappropriate behavior and 
ensure compliance with alt applicable 
laws, regulations and requirements, and 
include: 

• The development and distribution 
of written policies, procedures and 
standards of condu^ to prevent and 
detect inappropriate behavior; 

• The designation of a chief 
compliance officer and other 
appropriate bodies (for example a 
corporate compliance committee) 
charged with the responsibility of 
operating and monitoring the 
compliance program and who report 
directly to high-level personnel and the 
governing body; 

• The use of reasonable efforts not to 
include any individual in the 
substantial authority personnel whom 
the organization knew, or should have 
known, has engaged in illegal activities 
or other conduct inconsistent with an 
effective compliance and ethics 
program: 

• The development and 
implementation of regular, effective 
education and training programs for the 
governing body, all employees, 
including high-level personnel, and, as 
appropriate, the organization’s agents; 


• The maintenance of a process, such 
as a hotline, to receive complaints and 
the adoption of procedures to protect 
the anonymity of complainants and to 
protect whistleblowers from retaliation; 

• The development of a system to 
respond to allegations of improper 
conduct and the enforcement of 
appropriate disciplinary action against 
employees who have violated internal 
compliance policies, applicable statutes, 
regulations or Federal health care 
program requirements; 

• The use of audits and/or other 
evaluation techniques to monitor 
compliance and assist in the reduction 
of identiHed problem areas; and 

• The investigation and remediation 
of identified systemic problems 
including making any necessary 
modifications to the organization’s 
compliance and ethics program. 

In addition, we are particularly 
interested in comments about the 
following: 

• The extent to which, and the 
manner in which, providers and 
suppliers already Incorporate each of 
the seven U.S. Federal Sentencing 
Guidelines elements into their 
compliance programs or business 
operations. We are interested in how 
and to what degree each element has 
been incorporated effectively into the 
compliance programs of different types 
of providers and suppliers considering 
their risk areas, business model and 
industry sector or particular provider or 
supplier category. 

• Any other suggestions for 
compliance program elements beyond, 
or related to. the seven elements 
referenced previously considering 
provider or supplier risk areas, business 
model and industry sector or particular 
provider or supplier category including 
whether external and/or internal quality 
monitoring should be a required for 
hospitals and long-term care facilities. 

• The costs and benefits of 
compliance programs or operations 
including aggregate or component costs 
and benefits of implementing particular 
elements and how these costs and 
benefits were measured. 

• The types of systems necessary for 
effective compliance, the costs 
associated with these systems and the 
degree to which providers and suppliers 
already have these systems including, 
but not limited to, tracking systems, 
data capturing systems and electronic 
claims submission systems. We 
anticipate having providers and 
suppliers evaluate the effectiveness of 
their compliance plans using electronic 
data. 

• The existence of and experience 
with State or other compliance 


requirements for various providers and 
suppliers and foreseeable conflicts or 
duplication from multiple requirements, 

• The criteria we should consider 
when determining whether, and if so, 
how to divide providers and suppliers 
into groupings that would be subject to 
similar compliance requirements 
including whether individuals should 
have different compliance obligations 
from corporations. 

• Available research or individual 
experience regarding the current rate of 
adoption and level of sophistication of 
compliance programs for providers or 
suppliers based on their business model 
and industry sector or particular 
provider or supplier category. 

• How effective compliance programs 
have been for varied providers and 
suppliers and how the level of 
effectiveness was measured. 

• The extent to which providers and 
suppliers currently use third party 
resources, such as consultants, review 
organizations, and auditors, in their 
compliance efforts. 

• The extent to which providers and 
suppliers have already identified staff 
responsible for compliance and, for 
those who already have staff responsible 
for compliance, the positions of these 
staff. 

• A reasonable timeline for 
establishment of a required compliance 
program for various types and sizes of 
providers and suppliers, assuming the 
compliance program core elements were 
based on the aforementioned U.S. 
Federal Sentencing Guidelines’ seven 
elements of an effective compliance and 
ethics program, considering business 
model and industry sector or particular 
provider or supplier category. 

We welcomea any information 
concerning how the industry views 
compliance program elements and how 
we can establish required compliance 
program elements to protect Medicare, 
Medicaid, and CHIP from fraud and 
abuse. 

3. Analysis of and Responses to Public 
Comment 

We received numerous comments on 
compliance program elements in 
response to flvis request. Though we will 
not respond to those comments within 
this final rule with comment period, 
these will be considered for further 
rulemaking on compliance plan 
requirements. 

4. Final Provisions — Ethics and 
Compliance Program 

We are not finalizing these provisions 
in this final regulation. We are in the 
process of developing a new Notice of 
Proposed Rule Making incorporating the 
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compliance plan provisions and 
comments received that will be 
published at a later date. The proposed 
rule will also have an opportunity for 
further public comment. 

F. Termination of Provider Participation 
Under the Medicaid Program and CHIP 
if Terminated Under the Medicare 
Program or Another State Medicaid 
Program or CHIP 

1, Statutory Change 

Section 6501 of the ACA amends 
section 1902(a)(39) of the Act to require 
a State Medicaid program to terminate 
any provider, be it an individual or 
entity, participating in that program, 
subject to the limitations on exclusions 
in sections 1128(cK3KB) and 
1128(d)(3)(B) of the Act, if the 
provider’s participation has been 
terminated under title XVIli of the Act 
or another State’s Medicaid program. 
Effective provider screening prevents 
excluded providers from enrolling in 
government health care programs and 
being paid with Federal and State funds. 
Effective screening of providers barred 
from participation can reduce the risk of 
fraud, waste, and abuse in the Medicare 
and Medicaid programs and CHIP 
When a State terminates a provider 
but does not share that information with 
any other State, all other States become 
vulnerable to potential fraud, waste, and 
abuse committed by that provider. 
Similarly, a provider, supplier, or 
eligible professional that has been 
terminated from Medicare or has had 
Medicare billing privileges revoked may 
enroll with a State Medicaid program or 
with CHIP when a State is not aware of 
the Medicare termination or revocation. 
We may terminate or revoke the billing 
privileges of a provider, supplier, or 
eligible professional under Medicare for 
a number of reasons, as set forth at 
§424.535, including exclusion from 
health care programs, government-wide 
debarment, and conviction of certain 
violent felonies and financial crimes. 

Section 6501 of the ACA requires a 
State's Medicaid program to terminate 
an individual or entity's participation in 
the program (subject to certain 
limitations on exclusions in sections 
1128(cK3)(B) and 1128(d)(3)(B) of the 
Act), if the individual or entity has been 
terminated under Medicare or another 
State’s Medicaid program. Although the 
term “termination” only applies to 
providers under Medicare whose billing 
privileges have been revoked (and does 
not apply to Medicare suppliers or 
eligible professionals), we believe it was 
the intent of the Congress that this 
requirement also be applicable to 
suppliers and eligible professionals that 


have had their billing privileges under 
Medicare revoked as well. Therefore, we 
proposed that “termination” be inclusive 
of situations where an individual's or 
entity's billing privileges have been 
revoked. The requirement for States to 
terminate would only apply in cases 
where providers, suppliers, or eligible 
professionals were terminated or had 
their billing privileges revoked for 
cause. “For cause” may include fraud, 
integrity or quality, but not cases where 
the providers, suppliers, or eligible 
professionals were terminated or had 
their billing privileges revoked based 
upon voluntary action taken by the 
provider to end its participation in the 
program, except whore that voluntary 
action is taken to avoid a sanction, or 
where a State removes inactive 
providers from its enrollment files. 

In addition. State Medicaid program.'; 
would terminate a provider only after 
the provider had exhausted ail available 
appeal rights in the Medicare program 
or in the State that originally terminated 
the provider or the timeline for such 
appeal has expired. 

Section 6501 of the ACA builds upon 
the requirements in section 6401(b)(2) of 
the ACA, which requires that we 
establish a process to make available 
Medicare provider, supplier, and 
eligible professional and CHIP provider 
termination information to State 
Medicaid programs. Section 1902(kk)(6) 
of the Act also requires States to report 
adverse provider actions to CMS, 
including criminal convictions, 
sanctions, and negative licensure 
actions. 

When States are apprised of the 
terminations or revocations of billing 
privileges, as the case may be, of 
providers, suppliers, and eligible 
professionals that have occurred in 
other State Medicaid programs, CHIP, or 
in Medicare, States have the information 
they need to protect their programs. 

2. Proposed Provisions for Termination 
of Provider Participation Under the 
Medicaid Program and CHIP if 
Terminated Under the Medicare 
Program or Another Stale Medicaid 
Program or CHIP 

We proposed at § 455.416(c) that a 
State Medicaid program must deny 
enrollment or terminate the enrollment 
of a provider that is terminated on or 
after January 1, 2011 under Medicare, or 
has had its billing privileges revoked, or 
is terminated on or after January 1. 2011 
under any other State’s Medicaid 
program or CHIP. 

While section 6501 of the ACA does 
not expressly require that individuals or 
entities that have been terminated under 
Medicare or Medicaid also be 


terminated from CHIP, we also 
proposed, under our general rulemaking 
authority pursuant to section 1102 of 
the Act, to require in CHIP regulations 
that CHIP take similar action to 
terminate a provider terminated or 
revoked under Medicare, or terminated 
under any other State’s Medicaid 
program or CHIP. 

We also proposed to add a definition 
at §455.101 for termination for purposes 
of this section. That definition 
distinguishes between Medicaid 
providers and Medicare providers, 
suppliers, and eligible professionals and 
specifies that termination means a State 
Medicaid program or the Medicare 
program has taken action to revoke the 
Medicaid provider's or Medicare 
provider, supplier or eligible 
professional's billing privileges and the 
provider, supplier or eligible 
professional has exhausted all 
applicable appeal rights. There is no 
expectation on the part of the provider, 
supplier, or eligible professional or the 
State or Medicare program that the 
termination or revocation is temporary. 
The provider, supplier or eligible 
professional would be required to 
reenroll with the applicable program if 
they wish billing privileges to be 
reinstated. 

3. Analysis of and Responses to Public 
Comment 

We received the following comments: 

Comment: One commenter stated that 
while there is value to the States to have 
additional authority under which to 
deny or terminate Medicaid providers, it 
will be necessary to amend currant 
statute and regulations to include new 
reasons for denials and terminations, 
and additional time will be required. 

Response; In accordance witn section 
6508(b) of the ACA, a State may delay 
implementation of this provision if the 
Secretary determines that State 
legislation is required. 

Comment; Commenters asked for 
clarification regarding ACA section 
6401(b)(2) that requires CMS to 
establish a process to make available 
Medicare provider, supplier, and 
eligible professional and CHIP 
termination information to State 
Medicaid programs. Commenters asked 
if a mechanism was in place for States 
to check for terminated providers 
starting January 1 , 2011. One 
commenter requested clarification as to 
how State Medicaid programs would 
communicate with Medicare contractors 
when the States had revoked or 
suspended a Medicaid enrollment. 
Another commenter asked if the 
Provider Enrollment, Chain, and 
Ownership System (PECOS) would be 
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used. Another commenter stated it 
would be “next to impossible” to carry 
out this provision without an effective 
way to obtain information from 
Medicare regarding terminated 
providers. One commenter urged CMS 
to establish a national database that 
contains Medicare, CHIP termination 
and exclusion information as well as 
information on terminations from all 
State Medicaid programs. 

Besponse: We are in the process of 
establishing a secure web-based portal 
that will allow States to share 
information regarding terminated 
providers. Using this web-based portal, 
a State will be able to upload as well as 
download information regarding its 
terminated providers and download 
information regarding terminated 
providers in other States and Medicare. 
States will not be required to report 
those providers who were terminated 
prior to January 1, 2011. Access to the 
information-sharing portal is limited to 
users that we have approved. 

Comment: Some commenters 
requested that CMS clarify the 
timeframes for State reporting of 
terminations. 

Response: States should report 
terminations on a monthly basis in 
order to assist other States and the 
Medicare program in protecting 
themselves from providers who pose an 
increased risk to government health care 
programs. 

Comment: One commenter requested 
that States be granted real time access to 
the exclusion database. Another 
commenter suggested that CMS consider 
leveraging existing Federal databases 
such as the NPI and NPPES. 

Response: We are in the process of 
exploring potential opportunities to 
leverage existing databases and 
infrastructure that would enable timely 
access to provider enrollment data 
across programs. We are currently 
examining to what extent we can 
support such a centralized information 
sharing solution. 

Comment: One commenter requested 
clarification that Medicaid termination 
should only last as long as the Medicare 
termination, especially in States where 
“terminate” means “permanent 
exclusion.” 

Response; When a State terminates a 
provider based on the fact that the 
provider was terminated by Medicare, 
the duration of the State’s termination 
action should be consistent with State 
law, and not necessarily driven by the 
length of the Medicare termination. The 
same would hold true when a State 
terminates a provider based on a 
termination action in another State. We 


do not wish to dictate to States the 
duration of their terminations. 

Comment: One commenter contended 
that the proposed rule did not detail the 
parameters of the termination process. 
Specifically, it did not state what would 
happen if a provider is wrongfully 
terminated from participation in 
Medicare or another public benefit, or 
the different termination scenarios — 
such as the effect on a group practice if 
a provider in that group is suspected of 
fraud, The commenter also requested 
further explanation and clarification 
regarding the timeline and parameters 
for termination of provider participation 
in Medicare. Medicaid, and CHIP. 

Response: For purposes of the 
Medicaid program, the parameters of the 
termination process would be governed 
by the terminating State’s administrative 
appeals processes. Accordingly, the 
timeline and parameters for termination 
will vary depending on the State in 
which the termination occurs. State 
Medicaid agencies and CHIP must deny 
enrollment or terminate the enrollment 
of any provider that is terminated by 
Medicare or another State’s Medicaid 
program or CHIP on or after January 1 , 
2011 . If a provider is wrongfelly 
terminated from Medicare or another 
State’s Medicaid program or CHIP, and 
a subsequent State has already 
terminated such provider from its 
Medicaid program or CHIP, the 
subsequent State should reinstate the 
provider once the subsequent State has 
evidence demonstrating that the 
provider was wrongfully terminated. 

When an individual provider is 
terminated by a State Medicaid program 
or CHIP, the e^ect on a group practice 
would be that the individual provider 
who is terminated may not participate 
in the Medicaid or CHIP programs until 
that provider is eligible to. and does re- 
enroll. Therefore, neither the individual 
provider, nor the group practice would 
be able to bill Medicaid or CHIP for care 
and/or services provided by the 
individual provider that has been 
terminated. 

Comment: One commenter stated that 
termination is defined to be inclusive of 
situations where an individual or 
entity’s billing privileges have been 
revoked. The commenter requested 
clarification because not all providers 
have billing privileges. For example, a 
particular pharmacist may be denied 
participation in a State’s Medicaid 
program; however, because the 
pharmacist does not have direct billing 
privileges, another State would not have 
to also terminate that provider. 

Response; The requirement for 
termination is not limited to situations 
in which a provider is billing the 


Medicaid program. The requirement for 
termination applies to enrolled 
providers generally, not just billing 
providers. An enrolled provider that has 
had its billing privileges revoked by 
Medicare must be terminated by the 
States’ Medicaid programs, regardless of 
whether the provider is submitting 
claims. 

Comment; One commenter requested 
clarification for States regarding 
termination when a provider has more 
than one NPI or Medicare ID number. A 
commenter inquired if CMS will 
terminate a provider’s NPI, Medicare 
legacy number or both. This commenter 
also asked if a provider has multiple 
NPIs and/or Medicare numbers, does 
Medicare terminate a provider under 
one number but allow them to continue 
to participate under other NPI/Medicare 
numbers, This commenter indicated 
that if the response is yes, would a State 
be expected to follow suit, that is, 
terminate only the NPI that Medicare 
has terminated. Finally, the commenter 
asked what States should do in cases 
where providers have multiple legacy 
Medicaid numbers that crosswalk to a 
single NPI. 

Response: It is the provider, not the 
provider’s identifiers, which are to be 
terminated under this provision. Thus, 
to the extent that Medicare terminated 
one or multiple NPIs/Medicare legacy 
numbers for cause that are tied to one 
provider we generally expect that State 
Medicaid agencies will follow suit. 
Accordingly, if one provider has 
multiple Medicaid identification 
numbers, then the State would be 
required to terminate such provider 
numbers if the State determines there is 
cause for such termination and the 
provider has exhausted its appeal rights. 

Comment: Several commenters 
expressed concern over the potential for 
terminations of affiliated providers 
when one provider had been terminated 
in another State. One commenter asked 
if other State Medicaid agencies will be 
compelled to terminate affiliates that 
have a common corporate parent, A 
commenter asked if terminations for a 
corporation apply to any branches or 
franchises of that corporation. 

Response; Section 6501 of the ACA 
does not require the termination of 
affiliates of terminated entities. 
Accordingly, we are not requiring States 
at this time to terminate affiliates of 
those individuals or entities that have 
been terminated by another Medicaid 
program or had their billing privileges 
revoked by the Medicare program. 

Comment: One commenter stated that 
it is a common State statutory 
requirement or best practice for a 
provider to form a legal corporate entity 
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unique to the State. The commenter 
requested clarification for the legal basis 
for Federal enforceability of termination 
from or denied enrollment into a State’s 
program based upon the termination or 
denial status in another State where the 
provider and its principals are tho same 
individuals but the “provider” is a 
separate legally incorporated entity 
under State law. 

Response; Section 1902(a}(39) of the 
Act requires State Medicaid agencies to 
terminate the participation of any 
individual or entity that has been 
terminated under Medicare or another 
State’s Medicaid program. When a State 
is contemplating a termination as a 
result of a termination that was initiated 
by another State’s Medicaid program, 
and there is a question regarding the 
identity of the provider who is the 
subject of the termination, it is generally 
up to the subsequent terminating State 
to determine whether a provider in their 
State is the same provider that was 
initially terminated by another State’s 
Medicaid program. In order to 
determine whether a provider in one 
State is the same provider that was 
terminated in another State, a State 
could look at a variety of factors, 
including, but not limited to, NPI and 
correspondence address. The State 
could also communicate with the 
Medicaid agency that originally 
terminated the provider to help resolve 
the question of the provider’s identity. 

If the State believes that background 
checks are required to verify the identity 
of a provider, then States should 
conduct such background checks. We 
believe the States should have flexibility 
to determine the best method for 
identity verification. 

Comment: One commenter suggested 
that the regulatory definition of 
termination at §455.101 should be 
revised to include the termination of 
persons or entities with an ownership or 
control interest or who is an agent or 
managing employee of a provider. 

Response: The ACA does not 
contemplate termination based upon 
ownership or control. The statute 
requires termination of the same 
individual or entity that was terminated 
by Medicare or another State’s Medicaid 
program. 

Comment: A few commenters 
requested that CMS clarify in the final 
rule with comment period that 
termination from the Medicaid program 
must only occur when a provider has 
had billing privileges revoked or 
terminated by Medicare for cause, 

Response; The requirement for States 
to terminate would only apply in cases 
where providers, suppliers or eligible 
professionals were terminated or had 


their billing privileges revoked for cause 
which may include, but is not limited 
to, fraud, integrity or quality issues. In 
addition, we have defined ‘Termination” 
in the final rule with comment period 
as occurring when a State Medicaid 
program has taken action to terminate a 
provider and the provider has exhausted 
all applicable appeal rights that are 
available in the State or the Medicare 
program, or the timeline for appeal has 
expired, whichever is applicable. 

Comment: One commenter requested 
information regarding how managed 
care organizations will be able to access 
provider termination information. 

Response; We encourage States to 
share such information with their 
managed care entities. 

Comment; One commenter requested 
that an appeals process be established 
for providers and suppliers that would 
permit a provider/supplier to continue 
to provide care under a program if they 
can demonstrate “good cause 
exemptions.” 

Response; While we appreciate the 
commenter's suggestion, section 6501 of 
the ACA requires States to terminate the 
participation of any provider that has 
been terminated under Medicare or 
another State’s Medicaid program, and 
allows for exceptions only as permitted 
under sections 1128(c)(3)(B) and 
1128(d)(3)(B) of the Act. 

Comment; Commenters expressed 
concern that the proposed rule allows 
for the imposition of sanctions based 
upon findings made outside the agency. 
For example, if Medicare revokes a 
provider’s billing privileges and a State 
initiates a termination action as a result 
of such revocation, then, in the 
commenter’s view, the proposed rule 
gives the provider a right to use the 
State administrative appeal process to 
challenge anew the Medicare 
revocation. 

Response; We disagree. The provider 
is not provided a new forum in which 
to litigate the Medicare termination 
action. The ACA does not give a State 
the authority to review a Medicare 
termination action. The statute requires 
a State to terminate a provider that was 
terminated by Medicare or another 
State’s Medicaid program, with certain 
limited exceptions. 

Comment: A few commenters 
indicated that the proposed regulation 
fails to state that termination from the 
Medicaid program must only occur in 
situations in which the provider or 
supplier had its billing privileges 
terminated or revoked for cause, that is, 
fraud, integrity or quality issnes. 

Response; We agree. In the regulatory 
definition for “termination,” we will 
state that the requirement for States to 


terminate would only apply in cases 
whore providers, suppliers or eligible 
professionals were terminated or had 
their billing privileges revoked for cause 
which may include, but is not limited 
to. fraud, integrity or quality issues. 

Comment: Certain commenters 
requested a specific timeline for due 
process in connection with the appeal of 
termination actions and the parameters 
of the termination process in Medicaid. 

Response; As we have indicated 
previously in these responses, we 
believe that States should have the 
flexibility to decide termination actions 
consistent with their individual Slate 
administrative appeals process. In 
addition, since State law and 
regulations may vary with regard to this 
issue, we defer to the States regarding 
their existing termination processes. 

Comment; One commenter suggested 
that reciprocal termination must be 
limited to revocations of privileges due 
to fraud and where the physician has 
exhausted all possible appeal rights. 

Response; We agree. As stated in the 
proposed rule, the requirement for 
States to terminate would only apply in 
cases where providers, suppliers or 
eligible professionals were terminated 
or had their billing privileges revoked 
for cause. In addition, we defined 
“termination” os occurring when a State 
Medicaid program has taken action to 
revoke a Medicaid provider’s billing 
privileges and the provider has 
exhausted all applicable appeal rights 
that are available in that State, or the 
timeline for appeal has expired, or when 
the Medicare program has revoked the 
provider or supplier’s billing privileges 
and the provider or supplier has 
exhausted ail applicable appeal rights, 
or the timeline for appeal has expired. 

Comment; One commenter requested 
a definition of “eligible professional.” 

Response: In the context of 
terminations, “eligible professional” is a 
term that is specific to the Medicare 
program. For purposes of the Medicare 
program, an eligible professional may 
include a physician assistant, nurse 
practitioner, or clinical nurse specialist, 
certified nurse-midwife, clinical social 
worker, clinical psychologist, registered 
dietitian or nutrition professional. See 
section 1842(b){l8) of the Act. 

Comment; Certain commenters 
requested clarification regarding when a 
termination is triggered xmder the 
statute. 

Response: A termination in a 
subsequent State is triggered when 
Medicare or a State Medicaid program 
has taken action to revoke a provider’s 
billing privileges for cause and the 
provider has exhausted all applicable 
appeal rights that are available in 
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Medicare or the originally-terminating 
State or the timeline for appeal has 
expired. 

Comment: A commenter stated that 
section 6 of Executive Order 13132 
requires that: (1) Each agency have an 
accountable process to ensure 
meaningful and timely input by State 
officials in the development of 
regulatory policies that have Federalism 
implications, and (2) no agency shall 
promulgate any regulation that has 
Federalism implications that imposes 
substantial direct compliance cost on 
State governments. The commenter 
recommended that CMS explain the 
process that was used to ensure that 
meaningful and timely input was 
received from the States prior to the 
development of this proposed rule. 

Response: We have worked closely 
with State Medicaid agencies on the 
proposed rule and in the development 
of the final rule with comment period. 

Comment; One commenter requested 
clarification regarding the process of 
how Medicare reinstatements will be 
communicated to States and whether 
States will be required to automatically 
reinstate a provider in the Medicaid 
program once a provider “finishes the 
Medicare termination/revocation 
■period,” 

Response; Presumably, States will be 
notified by providers who are seeking 
re-enrollment or reinstatement in the 
Medicaid program, It is the 
responsibility of the States to validate 
the status of a provider's termination 
with Medicare, When a provider may 
seek re-enrollment is up to the 
discretion of the States and should be 
consistent with State law, Similarly, the 
duration of termination should be 
consistent with existing State law. 

4, Final Provisions for Termination of 
Provider Participation Under the 
Medicaid Program and CHIP if 
Terminated Under the Medicare 
Program or Another State Medicaid 
Program or CHIP 

We have retained the provisions of 
the proposed rule, with the exception of 
the following: 

• In § 455,101, we have added the 
following subsection (3) to the 
definition of termination; “The 
requirement for termination applies in 
cases where providers, suppliers, or 
eligible professionals were terminated 
or had their billing privileges revoked 
for cause which may include, but is not 
limited to: (i) Fraud; (ii) integrity; or (iii) 
quality.” 


G. Additional Medicare Provider 
Enrollment Provisions 

1. Statutory Changes 

Section 6501 of the ACA requires 
States to tenninate a provider or 
supplier under the Medicaid program 
when the provider or supplier has been 
terminated by Medicare or by another 
State’s Medicaid program. We believe 
that permitting CMS to revoke Medicare 
billing privileges when a State Medicaid 
agency terminates, revokes, or suspends 
a provider or supplier’s Medicaid 
enrollment or billing privileges works in 
tandem with section 6501 of the ACA. 

2. Proposed Provisions for Additional 
Medicare Provider Enrollment 

In § 424.535{a)(ll). we proposed 
allowing CMS, directly or through its 
contractor, to revoke Medicare billing 
privileges when a State Medicaid 
agency terminates, revokes, or suspends 
a provider or supplier’s Medicaid 
enrollment or billing privileges. 
Moreover, we believe that providers and 
suppliers whose enrollment has been 
terminated by a State Medicaid program 
may pose an increased risk to the 
Medicare program. 

3. Analysis of and Response to Public 
Comments 

We received one comment on the 
proposed provision related to Medicare 
termination. 

Comment: A commenter stated that 
proposed §424.535(a)(11) contains an 
editorial error that makes the language 
of the proposed rule difficult to 
understand. 

Response; Section 424.535(a} lists 
reasons for revocation of Medicare 
enrollment. §424.535(a)(12) is one such 
reason — if a State has terminated a 
provider from Medicaid. Medicare can 
terminate the provider from Medicare. 
We will reword the language in 
§ 424.535(a)(12) to clarify the 
circumstances being addressed. 

4. Final Provisions for Additional 
Medicare Provider Enrollment 

This final rule with comment period 
finalizes the provisions of the proposed 
rule in regards to our discretion to 
revoke a provider or supplier's Medicare 
billing privileges when terminated, 
revoked or suspended by a State 
Medicaid agency with no modifications. 

H. Technical and General Comments 

Comment: A commenter slated that 

the definition of “provider of services” 
in section lB61(u} of the Act and 
“supplier” in section 1861(d) of the Act 
differs from the meaning of “provider of 
services” and “supplier," respectively, in 


the proposed rule. The commenter also 
was unclear as to whether the proposed 
rule’s references to “providers” refer to 
“provider of services.” The commenter 
requested clarification on both issues. 

Response: The proposed rule stated 
that in Medicare, the term provider of 
services under section 1861 (u) of the 
Act means health care entities that 
furnish services primarily payable 
under Part A of Medicare, such as 
hospitals, home health agencies 
{including home health agencies 
providing services under Part B), 
hospices, and skilled nursing facilities. 
The term “suppliers” defined in section 
1861(d) of the Act refers to health care 
entities that furnish services primarily 
payable under Part B of Medicare, such 
as independent diagnostic testing 
facilities (IDTFs), durable medical 
equipment prosthetics, orthotics, and 
supplies (DMEPOS) suppliers, and 
eligible professionals, which refers to 
health care suppliers who are 
individuals, that is, physicians and the 
other professionals listed in section 
1848(k)(3){B) of the Act. For Medicaid 
and CHIP, we use the terms “providers” 
or “Medicaid providers” or "CHIP 
providers” when referring to all 
Medicaid or CHIP health care providers, 
including individual practitioners, 
institutional providers, arid providers of 
medical equipment or goods related to 
care, The term “supplier” has no 
meaning in the Medicaid program or 
CHIP, 

Comment; A commenter suggested 
that to avoid misinterpretation, non- 
physician practitioners should be 
clearly defined in the final rule with 
comment period, 

Response; TTie proposed and final 
rule with comment period refer to non- 
physician practitioners to mean any 
non-physician practitioner who is 
eligible to enroll in Medicare, Medicaid 
or CHIP under existing regulations and 
statutes. In addition, this term is already 
defined at section 1848(b)(18)(C) of the 
Act, 

Comment; A commenter stated that 
with the issuance of CMS-1510-F on 
November 2, 2010, CMS should 
renumber the denial and revocation 
reasons found in this proposed rule. In 
CMS-1510-F, CMS finalized a new 
denial reason in § 424.530(aK8) and a 
new revocation reason in 
§424.535(a)(l2). 

Response: We have revised these 
provisions in the regulatory text. 

Comment; A commenter stated that 
CMS violated section 6{a) of Executive 
Order 12866 by not giving the public a 
60 day review period for this rule and 
that CMS only allowed a 55 day review 
period, The commenter also could not 
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find a CMS Press Release or information 
on the CMS Web site indicating that 
CMS notified the public that it placed 
this rule on display and began the 
public comment period in advance of 
the publication of the proposed rule in 
the Federal Register. The commenter 
recommended that CMS reissue a new 
proposed rule or extend the comment 
period for this proposed rule by 
additional 60 days. 

Response: The Department ofHealth 
and Human Services released a press 
release on September 20 , 2010 
accessible on its Web site that 
announced the display of the proposed 
rule at the Federal Register. The press 
release is accessible at: http:// 
www.hhs.gOv/news/press/20Wpres/09/ 
20t00920e.html. Additional media 
outlets reported the proposed rule 
display on September 17th, 2010. We do 
not believe it is appropriate to extend 
the comment period for an additional 60 
days, and we have taken into account all 
comments received during the comment 
period. 

Comment: Several commenters stated 
that the proposed timeframe for 
implementation and compliance is 
extremely aggressive. First, smaller, 
rural providers and suppliers may not 
be organizationally able to fully comply 
without significant cost and effort, thus 
impacting access to care. Second, the 
DME MACs and the NSC will have to be 
able to identify suppliers and 
implement payment edits, both by 
specialty code. 

Response; As stated previously, the 
timeline is a required under the ACA. 
We have been working closely with our 
contractors and with providers and 
suppliers to ensure that compliance 
with this final rule with comment 
period will not affect patients' access to 
health care. 

Comment: Several commenters stated 
that the implementation timetables for 
this proposed rule were too ambitious, 
and that sufficient lead time is 
necessary for CMS to have operational 
computer programs in place to 
administer these requirements correctly 
and consistently. 

Response: This final rule with 
comment period is implementing 
provisions of the ACA which sets forth 
deadlines for implementation of the 
screening provisions. 

Comment: A commenter stated that in 
its manual instructions, CMS describes 
the verification of legalized status for 
physicians and non-physician 
practitioners. However, the commenter 
stated that the proposed rule is silent 
regarding the verification or screening 
process that will be used to determine 
legal status of an owner, authorized 


official, delegated official, managing 
employee, physician or non-physician. 
The commenter recommended that CMS 
explain this process in the proposed 
rule. Another commenter urged CMS to 
revise its existing CMS-855 enrollment 
applications to include questions on 
residency, legal status, and/or 
citizenship, arguing that this would 
help reduce fraud. 

Response: Information collected on 
the CMS-855 enrollment applications 
are used to verify residency, including 
the Social Security Number and the 
Date of Birth. This process is a part of 
the general screening process, and is 
applied to all screening levels, 
including limited. 

Comment; A commenter stated that 
since illegal immigrants are not legally 
authorized to work in the United States 
or own or operate a business in the 
United States, CMS should; (1) 
Coordinate and verify both the identity 
and work status of any individual 
practitioner or owner with the United 
States Citizenship and Immigration 
Services, and (2) establish new 
Medicare, Medicaid and CHIP denial 
and revocation reasons when an 
individual is not authorized to work in 
the United States legally and that CMS 
refer any individuals to the appropriate 
authorities for expulsion from the 
United States. 

Response: As stated previously, we 
have existing procedures in place that 
verify an applicant’s eligibility to work 
in the United States. 

Comment: One commenter 
recommended that CMS furnish the 
number of providers and suppliers by 
specialty type that have or do not have 
an enrollment record in PECOS. This 
will, the commenter believes, help 
clarify the impact of this rule on 
providers and suppliers. 

Response: This unal rule with 
comment period does not impact the 
enrollment requirements related to 
PECOS for providers and suppliers. In 
May of 2010, we published CMS — 
6010-IFC which required all physicians 
and eligible professionals who order 
and refer home health services or Part 
B items and services (excluding Part B 
drugs) to Medicare to be enrolled in 
PECOS. Additional communications 
have been published with regard to that 
interim final rule with comment period, 
and do not impact the provisions 
finalized here. This final rule with 
comment period established the 
screening requirements for providers 
under Medicare, Medicaid and CHIP, 
and application fees for newly enrolling 
or revalidating providers. All newly 
enrolling or revalidating providers must 
establish records in PECOS as this is the 


only available enrollment option at this 
time. 

Comment: A commenter stated that 
Medicare, Medicaid and CHIP must 
work in tandem to assnre compliance, 
so that bad actors cannot move from one 
program to another and shelter 
themselves through the lack of 
coordinated data, standards, 
information and enforcement. 

Response; We concur with this 
comment. This final rule with comment 
period implements the ACA provision 
that requires State Medicaid Agencies, 
to terminate a provider when a provider 
has been terminated by Medicare added 
at §455.416. This final rule with 
comment period also implements 
regulations at § 455.470 that authorizes 
State Medicaid agencies to impose a 
temporary moratoria when Medicare 
imposes such a moratoria, except when 
the State Medicaid agency determines 
an imposition would affect 
beneficiaries’ access. These provisions 
are directly aimed at eliminating the 
type of program abuses addressed by the 
commenter. 

Commenf; A commenter stated that 
despite the additional burdens it will 
create, it supported the proposed rule 
because there is no alternative. The 
commenter stated that if fraud, abuse 
and waste are not eliminated and 
quality improvement is not made 
centra) to home health and hospice, It 
feared for the future of home-based care 
when it is needed most. 

Response; We agree with the 
commenter. We believe that these 
provisions are intended to protect the 
integrity of these programs for future 
generations. 

Comment; A commenter suggested 
that CMS should change its contractors’ 
claims processing system to a system 
similar to that used by credit card 
companies, This will help ensure that 
fraud and abuse can be detected in real 
time, rather than later. 

Response: We are continually 
exploring additional improvements to 
our data systems, but disagree with the 
commenter’s suggestion that we must 
change all of our contractors systems to 
implement real time data analysis. We 
are committed to working with both 
private and public partners to evaluate 
technologies that can provide the 
scalability and safeguards to beneficiary 
access that are necessary to ensure 
accurate payments to legitimate 
providers for appropriate services 
sup^plied to enrolled beneficiaries. 

Comment: A commenter stated that 
CMS should establish a new 
requirement that organized medical 
staffs and hospitals report the provision 
of (but not the results of) peer review as 
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a quality indicator, and that CMS 
should post the quality indicator for 
each hospital department on its Hospital 
Compare Web site, together with an 
explanation of the importance of peer 
review to assure patient safety, quality, 
and identification of medically 
unnecessary services. 

Response: This comment is beyond 
the scope of this rule. This final rule 
with comment period does not address 
the reporting of quality indicators or the 
Hospital Compare Web site. 

Comment: A commenter stated that 
MACs should no longer accept certain 
CPT codes for laboratory test payments. 

Response: This comment is beyond 
the scope of this rule. This final rule 
with comment period does not address 
our coverage and payment decisions for 
CPT codes, 

Comment: A commenter stated that 
CMS should consider bidding out 
laboratory coding to a contractor, 
similar to the manner in which the 
PDAC operates for DME coding, 

Response: This comment is Beyond 
the scope of this rule. This final rule 
with comment period does not address 
the bidding of laboratory coding to a 
contractor. 

Comment: A commenter expressed 
support for many of the details and 
provisions contained within the 
proposed rule and requested that CMS 
continue to seek input bom all 
stakeholders about matters related to 
hospitals and health systems. 

Response: We concur with the 
commenter’s request to continue to seek 
input bom all stakeholders, and fully 
intend to do so in regard to the 
requirements of this final rule with 
comment, as well as annual payment 
regulations. 

Comment; A commenter expressed 
concern that anti-baud laws and 
regulations, adopted to root out 
unscrupulous activity resulting bom 
criminal intent, are increasingly used to 
impose harsh penalties for inadvertent 
mistakes and contribute to the 
escalating costs of health care as 
providers attempt to comply with 
increasingly voluminous and 
sophisticated systems and requirements. 

Response: We continually balance the 
necessity to eliminate baud, waste, and 
abuse with reducing the burden on 
legitimate providers, suppliers, and 
beneficiaries, Section 6401 of the ACA 
requires that the Secretary determine 
the level of screening according to the 
risk of baud, waste, and abuse. This 
final rule with comment period 
implements this provision by instituting 
levels of screening based on risk of 
fraud, waste, and abuse, and has the 
flexibility to adapt to future 


developments by adiusting the 
categories as appropriate. We will use 
this new authority to prevent just such 
situations as described by the 
commenter, and will reduce the burden 
on legitimate providers who may make 
mistakes, and target baud prevention 
resources appropriately. 

Comment: A commenter stated that 
serial number tracking should be 
considered for much of the equipment 
provided by DMEPOS suppliers, similar 
to the Vehicle Identifier Number (VIN) • 
system used in the transportation 
manufacturing industry. 

Response: While we appreciate this 
comment, it appears to be outside the 
scope of this rule. Also, this comment 
would require a thorough evaluation of 
the cost of such a requirement on 
DMEPOS suppliers, the access issues it 
could potentially cause to beneficiaries 
if we mandated that only serial 
numbered equipment must be provided 
to beneficiaries, the additional system 
requirements that we would need to 
enhance to track such equipment, and 
the estimated benefit from such a 
requirement. 

Comment: A commenter stated that 
the fight against health care fraud would 
be bolstered if Medicare, Medicaid and 
private insurers would share 
information about providers' enrollment 
and billing patterns. The commenter 
therefore recommended that CMS: (1) 
Revise its regulations and the CMS-855 
to collect information about all other 
health care payers, and (2) share the 
information it collects via the 
enrollment and payment process with 
private payers, Medicaid, and Medicare 
Advantage Organizations. 

Response: We would have to carefully 
evaluate the commenter’s proposal. We 
must go through notice of rulemaking 
and comment period before revising any 
regulation. Additionally, we would have 
to carefully consider the privacy issues 
that accompany increased data sharing, 
especially with private payers, and 
weigh the potential concerns of 
providers and suppliers with the 
expected benefit of such a measure, ' 
However, we have been working closely 
with private and public partners 
regarding strategies to effectively work 
together to have a broad view of the 
health care claim landscape, and will 
continue to evaluate opportunities to 
collaborate on the improved detection of 
health care baud. 

Comment: A commenter urged CMS 
to consider ways to enhance Medicare 
CoPs for home health and hospice 
providers to achieve more lasting 
changes. The commenter stated that 
CMS withdrew the proposed CoPs 
changes for home healA in 1997 and 


has not taken further action, The 
commenter recommended that CMS 
consult with provider groups to revise 
and finalize the CoPs for home health as 
quickly as possible. 

Response: This comment is outside of 
the scope of the final rule with comment 
period. 

Comment: A commenter 
recommended that CMS: (1) Provide the 
direct savings that have resulted bom 
provider screening activities between 
2000 and 2010, (2) calculate the savings 
to the Medicare Trust Funds and the 
General Fund based on this proposed 
rule, and (3) explain whether the 
estimated savings will result in fewer 
actual dollars spent on health care or 
whether the changes proposed will only 
slow the expenditure growth. 

Response: We believe that all of the 
agency’s program integrity activities 
have resulted in savings to the Trust 
Fund and the General Fund. We are not 
required to report a return on 
investment regarding historical 
screening initiatives, or project savings 
regarding the statutory requirements. 
The fact that we have in the past denied 
any application means that we have 
prevented an unqualified provider or 
supplier bom providing services and/or 
care to Medicare beneficiaries that could 
have resulted in physical harm or 
financial loss to such a beneficiary. 

Comment: One commenter stated that 
this proposed rule will be ineffective in 
halting baud because it is reactive, and 
it is impossible for any government 
entity to react in a timely manner. 

Response: We disagree with the 
comment that the new authorities in 
this final rule with comment period are 
reactive. Particularly, the screening 
requirements for newly enrolling 
providers which will proactively 
prevent individuals bom entering the 
Medicare, Medicaid and CHIP programs 
for the sole purpose of debauding 
taxpayers. Temporary moratoria will 
also permit the agency to develop a 
strategy to mitigate the risk of baud 
while stopping the pace of potentially 
fraudulent enrolling providers. We 
believe these new tools will enable us 
to become a more proactive gatekeeper 
of the Medicare Trust Fund. 

Comment: A commenter 
recommended that all providers and 
suppliers be subject to the provisions 
associated with section 6401(a)(3) of the 
ACA, 

Response: This comment is outside of 
the scope of this final rule with 
comment period. 

Comment: A commenter contended 
that QMS's statement in the preamble 
that Medicare is the primary payer of 
health care for 45 million enrolled 
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beneficiaries is incorrect. The correct 
number should be more than 47 million. 
The commenter also recommended that 
CMS provide the number of Medicare 
beneficiaries that are enrolled in 
Medicare Advantage plans. 

Response: We will address this . 
correction in the preamble. The 
provisions of this final rule with 
comment period do not apply to 
Medicare Advantage plans, so the 
number of Medicare Advantage-enrolled 
beneficiaries would not be relevant to 
the preamble. 

Comment: A commenter questioned 
whether CMS could implement the 
provisions of this proposed rule when 
information on its provider enrollment 
Web site is not regularly updated, 

Response: We are implementing 
provisions of this proposed rule, and are 
working with the provider community 
in various outlets, including its provider 
Web site. The provider enrollment Web 
site will reflect the requirements of this 
final rule with comment period. 

Comment: Several commenters stated 
that the Federal and State programs will 
be more efficient if they recognize 
another program’s enrollment 
determinations, decisions to suspend 
payments, and imposition of moratoria. 
To handle the complexity and 
coordination of monitoring participation 
and appropriately suspending payments 
or terminating contracts with providers 
and suppliers, the commenter 
recommended CMS develop and 
maintain a central, consoliaated 
database for housing participation 
status, suspension of payments and 
imposed moratoria for all three 
programs. The commenters stated that 
CMS should also strengthen and expand 
efforts to coordinate data sharing 
between government health programs 
across the various Federal agencies, as 
well sharing of information with MAOs, 
MCOs and CHIP sponsors. 

Response: We agree with the previous 
comment that we should seek to become 
more efficient by sharing screening 
determinations, decisions to suspend 
payments and imposition of enrollment 
moratoria to the extent possible under 
applicable laws. We are continually 
evaluating and strengthening efforts to 
coordinate data sharing between health 
programs across various agencies. 

Comment: A commenter stated that 
regulators and industry need to work 
together to minimize the impact of sham 
companies and other instances of fraud, 
and that this proposed regulation is a 
step in the ri^t direction. 

Response: We agree with this 
comment. 


111. Collection of Information 
Requirements 

Under the Paperwork Reduction Act 
of 1995, we are required to provide 60- 
day notice in the Federal Register and 
solicit public comment before a 
collection of information requirement is 
submitted to the Office of Management 
and Budget (OMB) for review and 
approval. In order to fairly evaluate 
whether an information collection 
should be approved by OMB, section 
3506{c){2}(A) of the Paperwork 
Reduction Act of 1995 requires that we 
solicit comment on the following issues: 

• The need for the information 
collection and its nsefulness in carrying 
out the proper functions of our agency. 

• The accuracy of our estimate of the 
information collection burden. 

• The quality, utility, and clarity of 
the information to be collected. 

• Recommendations to minimize the 
information collection burden on the 
affected public, including automated 
collection techniques. 

We solicited public comment on each 
of these issues for the following sections 
of this document that contain 
information collection requirements 
(ICRs): 

' For this final rule with comment 
period, we will be retaining the 
Collection of Information estimates in 
the proposed rule, in accordance with 
the discussion below. 

A. ICRs Regarding Medicare Application 
Fee Hardship Exception (§424.514) 

Section 424.514(e) states that a 
provider or supplier that believes it has 
a hardship that justifies a waiver 
exception of the application fee must 
include with its enrollment application 
a letter that describes the hardship and 
why the hardship justifies a waiver 
exception. The burden associated with 
this requirement is the time and effort 
necessary to submit a Medicare 
enrollment application, which is 
required currently of any individual or 
entity enrolling in Medicare. In addition 
to the enrollment application, a 
provider or supplier would have the 
new burden of drafting and submitting 
a letter to justify its hardship waiver 
request should it choose to submit one. 
The burden associated with submitting 
Medicare enrollment applications A, B, 
1, R and CMS-855S, are currently 
approved under Office of Management 
and Budget (OMB) control numbers 
0938-0685 and 0938-1057, 
respectively). Although we have no way 
of knowing for certain how many 
entities will actually submit an 
application with a letter requesting a 
waiver, we know that there are likely to 


be more such requests in the early years 
of implementation than in later years. 

We estimated that in the first year, 

12.000 providers or suppliers — or 
slightly over 50 percent of the total 
number of providers and suppliers that 
we believe will be subject to the 
application fee — ^will submit waiver 
request letters as part of their 
application packages. (As stated in the 
preamble, the application fee does not 
apply to individual eligible 
professionals nor to group practices of 
these individual professionals.) We also 
estimated that it will take each provider 
or supplier 1 hour to develop the letter. 
The total estimaited annual burden 
associated with this requirement is 
therefore 12,000 hours at a cost of 
$600,000, or $50.00 per waiver request. 

B. ICRs Regarding Medicare 
Fingerprinting Requirement (§ 424.51 8) 

Consistent with § 424.518 we will 
require the submission of a set of 
fingerprints — either electronically 
collected by CMS’ authorized channeler 
or using the FD-258 standard 
fingerprint card obtained from the local 
law enforcement agency that collected 
the fingerprints — from all individuals 
who maintain a 5 percent or greater 
direct or indirect ownership interest in 
a prospective HHA or DMEPOS supplier 
that is enrolling in Medicare, We 
estimate that CMS or its designated 
contractors will make 7,000 such 
requests per year. This is predicated on 
our projection that — based on 2009 
statistics — roughly 7,000 DMEPOS 
suppliers and HHAs will annually 
enroll in Medicare. For purposes of this 
ICR statement only, and to ensure that 
we do not underestimate the possible 
burden, we estimate that all of these 
providers and suppliers will be required 
to submit fingerprints, We further 
estimate that an average of five 
individuals per provider or supplier 
will be required to comply vrith this 
request. (It must be noted that for 
purposes of this ICR and the RlA below, 
we sought comments on whether the 
estimate of five individuals per 
applicant is accurate. No comments 
were received.) Additionally, we 
estimate that it will take each of the 

35.000 respondents (7,000 provider 
requests x 5 respondents per provider 
request) an average of 2 hours to obtain 
and snbmit fingerprints. Consequently, 
the total estimated annual burden 
associated with this requirement is 

70.000 hours (35,000 responses x 2 
hours per response) at a cost of $3,5 
million (70,000 hours x $50 per hour). 

Sections 424.518(c)(3)(ii) and (iii) call 
for the submission of a set of 
fingerprints for a national background 
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check from all individuals who 
maintain a 5 percent or greater direct or 
indirect ownership interest in a 
provider or supplier that has moved into 
the “high” risk category based on an 
adverse action or the lifting of a 
moratorium. The burden associated 
with this requirement is the time and 
effort necessary for the individual to 
submit the required information upon 
request. We estimate that CMS or its 
designated contractors will make 2,000 
requests per year. This is based on the 
number of providers and suppliers that 
we estimate will attempt to enroll in 
Medicare: (1) After the lifting of a 
moratorium for their respective provider 
or supplier type, or ( 2 ) that have had 
one of the adverse actions in 
§ 424.518(c)(3){ii) imposed against it. 
This estimate of course, cannot he 
conclusively quantified because it is 
impossible for us to say with certainty 
which provider and supplier types will 
be subject to a moratorium. To ensure 
that we do not underestimate the 
potential burden, we also calculated 
projections should 5,000 or 1 0,000 
requests he made. 

We estimate that an average of five 
individuals per provider or supplier 
will he required to comply with this 
request. We further project that it will 
take each of the 10,000 respondents 
(2.000 provider or suppliers requests >: 

5 respondents per provider or supplier 
request) an average of 2 hours to obtain 
and submit the fingerprints. The 
estimated annual burden associated 
with this requirement, based on 2,000 
requests is 20,000 hours (10,000 
respondents x l response per 
respondent x 2 hours per response) at a 
cost of Si million (20,000 hours x $50 
per hour). If 5 ,000 requests are made, 
the burden is 50,000 hours at a cost of 
S2.5 million (5,000 requests x 5 
responses per request x 2 hours per 
response x $50 per hour.) If 10,000 
requests are made, the burden is 
100,000 hours at a cost of $5 million 
(30,000 requests x 5 responses per 
request x 2 hours per response x $50 per 
hour).® 

In addition, there are some limited 
circumstances when CMS could ask a 
physician to submit fingerprints. For 
example, a provider or supplier that is 
being enrolled in Medicare after the 
lifting of a temporary moratorium could 
automatically be classified as “high” risk 
and, as such, would be subject to 
criminal background checks and 
fingerprinting of owners of the 
company. If a physician were to have a 


®Nola ihat these figures pertain only to 
individuals who are not phy.sicians. Physicians are 
addressed in the following paragraph. 


5 percent or greater direct or indirect 
ownership interest in the provider or 
supplier, CMS would have the authority 
to request fingerprints from him or her. 
Other circumstances might include 
when a physician has had an adverse 
action imposed against him or her and, 
in accordance with § 424.518(c)(3)(ii), 
has been placed in the “high” risk 
category. We estimate that CMS or its 
designated contractors will make 500 
such requests for fingerprints per year. 
We further estimate that it will take 
each of the 500 respondents a total of 2 
hours to obtain and submit the 
fingerprints. The total estimated annual 
burden associated with this requirement 
is 1,000 hours (500 respondents x 1 
response per respondent x 2 hours per 
response) at a cost of $50,000 (1,000 
hours X $50 per hour). 

Therefore, assuming that 2,000 post- 
moratorium requests for fingerprints are 
made, the total estimated annua! burden 
associated with the Medicare 
requirements in this ICR is 103,000 
hours at a cost of $5,150,000. If 5,000 
post-moratorium requests are made, the 
estimated annual burden is 133,000 
hours at a cost of $6,650,000. If 10,000 
post-moratorium requests are made, the 
estimated annual burden is 163,000 
hours at a cost of $9,150,000. 

Comment; In the collection of 
information requirements section of this 
proposed rule, CMS used 2009 statistics 
for estimating the number of individuals 
that will need to undergo fingerprinting. 
A commenter recommended that CMS 
update these estimates using 2010 data. 

Response: We believe it is more 
appropriate to use the most recent full 
year's data. 

Comment: A commenter contended 
that CMS’s estimate that it will take 2 
hours to obtain a set of fingerprints 
using the FD-256 standard fingerprint 
card seems low. The commenter 
recommended that CMS provide the 
analysis used, Including literature 
review, to estimate the time it will take 
to obtain a set of fingerprints using the 
FD-258 fingerprint card. The 
commenter also asked that CMS explain 
whether there are any alternatives to the 
FD-258 standard fingerprint card and, if 
there are, the costs associated with these 
alternatives. 

Response; We believe that the 2 hour 
figure, which was based on our analysis 
of a number of materials, is accurate. 
Since the FD-258 is the standard 
fingerprint card, we focused primarily 
on the use of this format in the propo.sed 
rule. However, as explained in the 
preamble to this final rule with 
comment period, electronic fingerprints 
will be an aiternativo — and one that wo 
will encourage — ^to the FD— 258. 


C. ICRs Regarding Medicaid 
Fingerprinting Requirement (§ 455.434) 

Section 455.434 states that when a 
State Medicaid agency determines that a 
provider is “high” risk, the State 
Medicaid agency will require that 
provider to submit fingerprints. We 
anticipate that States will be collecting 
fingerprints on a significantly smaller 
number of providers. However, as with 
our estimates of the potential burden for 
the Medicare requirements, we 
preferred to overestimate the potential 
burden rather than underestimate it. 
Therefore, we anticipate that States may 
require an additional 26,000 individuals 
to submit fingerprints prior to enrolling 
in a State's Medicaid program or CHIP. 
The total estimated annual burden 
associated with this requirement for 
Medicaid and CHIP is 52,000 hours 
(26,000 respondents x l response per 
respondent x 2 hours per response) at a 
cost of $2.6 million {52,000 hours x $50 
per hour). 

D. ICRs Regarding Suspension of 
Payments in Cases of Fraud or Willful 
Misrepresentation (§455.23) 

As stated in § 455.23(a), a State 
Medicaid agency must suspend all 
Medicaid payments to a provider when 
there is pending an investigation of a 
credible allegation of fraud under the 
Medicaid program against an individual 
or entity unless it has good cause to not 
suspend payments or to suspend 
payment only in part. The State 
Medicaid agency may suspend 
payments without first notifying the 
provider of its intention to suspend 
such payments. A provider may request, 
and must be granted, administrative 
review where State law so requires. 

The burden associated with this 
requirement is the time and effort 
necessary for a provider to request 
administrative review where State law 
so requires. While this requirement is 
subject to the PRA, we believe the 
associated burden is exempt in 
accordance with 5 CFR 1320.4. 

E. ICRs Regarding Collection of SSNs 
and DOBs for Medicaid and CHIP 
Providers (§455.104) 

As stated in §455. 104(b)(1), tlie State 
Medicaid agency must require that all 
persons with an ownership or control 
interest in a provider submit their SSN 
and DOB. The burden associated with 
the Medicaid requirements in 
§ 455.104(b)(1) is the tima and effort 
necessary for a provider to report the 
SSN and DOB for ail persons with an 
owner-ship or control interest in a 
provider. 

Although our data on Medicaid 
provider enrollment at the national level 
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is very limited, we do collect annual 
data on State Medicaid program 
integrity activities. This annual data 
collection, known as the State Program 
Integrity Assessment (SPIA) program, 
approved under OCN 0938-1033, 
consists of self-reported data by States 
regarding a variety of program integrity 
related activities. The information is 
self-reported and has not been 
independently verified by CMS, and it 
undoubtedly represents some unknown 
degree of duplication among providers 
across States. Consequently, the 
estimated number of Medicaid 
providers nationally is likely overstated. 

According to SPIA data for FFYs 2007 
and 2008, there has been an average of 
1,855,070 existing Medicaid providers 
nationally over the 2 year period of FFY 
2007 and FFY 2008. We estimate that 
one-fifth or 371,014 (1,855.070 x 20 
percent) of existing Medicaid providers 
would be required to re-enroll each 
year. Additionally, we estimate that 
there will be 56,250 newly enrolling 
Medicaid providers each year, for a total 
of 427,264 Medicaid providers that will 
be subject to the SSN and DOB reporting 
requirements each year. We further 
estimate that it will take each provider 
an average of 2 minutes to report the 
SSN and DOB for all persons with an 
ownership or control interest. Thus, the 
estimated annual burden associated 
with this requirement for Medicaid 
providers is 14,242 hours (427,264 x (2 
minutes, divided by 60 minutes per 
hour)) at a cost of $712,100 (14.242 
hours X $50 per hour). 

F. ICRs Regarding Site Visits for 
Medicaid-Only or CHIP-Only Providers 
(§455.450) 

As stated in §455, 450(b), a State 
Medicaid agency must conduct on-site 
visits for providers it determines to be 
“moderate” or “high” categorical risk. 

We anticipate that Medicare contractors 
will perform the screening activities for 
the overwhelming majority of providers 


that are dually enrolled in both 
Medicare and Medicaid and thus, we 
estimate that State Medicaid agencies 
will conduct approximately 5,000 site 
visits for Medicaid-only providers 
nationally per year. We further estimate 
that if will take one individual 8 hours 
to perform each on-site visit {including 
travel time). Thus, the total estimated 
annual burden associated with this 
requirement for Medicaid is 40,000 
hours (5,000 site visits x 8 hours) at a 
cost of $2,000,000 (40,000 hours X $50 
per hour). 

G. ICRs Regarding the Rescreening of 
Medicaid Providers Every 5 Years 
(§455.4U) 

As stated in §455.414, a State 
Medicaid agency must screen all 
providers at least every 5 years. This 
requirement is consistent with the 
Medicare requirement that providers, 
suppliers, and eligible professionals 
must re-enroll at least every 5 years 
(more often for certain types of 
suppliers). The burden associated with 
this requirement would be the time and 
effort necessary for Medicaid-only 
providers to re-enroll in Medicaid, and 
the time and effort necessary for a State 
to conduct the provider screening. 

Although our data on Medicaid 
provider enrollment at the national level 
is very limited, we do collect annual 
data on State Medicaid program 
integrity activities. As previously 
explained, this annual data collection, 
known as the State Program Integrity 
Assessment (SPIA) program, consists of 
self-reported dato by States regarding a 
variety of program integrity related 
activities. The information is self- 
reported and has not been 
independently verified by CMS, and it 
undoubtedly represents some unknown 
degree of duplication among providers 
across States. Consequently, the 
estimated number of Medicaid 
providers nationally is likely overstated. 


According to SPIA data for FFYs 2007 
and 2008, there has been an average of 
1,855.070 existing Medicaid providers 
nationally over the 2 year period of FFY 
2007 and FFY 2008. We estimate that 
one fifth, or 371,014 (1,855,070 x 20 
percent), of existing Medicaid providers 
would be required to re-enroll each 
year. Although provider enrollment 
requirements vary by State, we further 
estimate that it will take each, provider 
an average of 2 hours to complete the 
Medicaid re-enrollment requirements. 
Thus, the estimated annual burden 
associated with this requirement for 
Medicaid providers is 742,028 hours 
(371,014 responses x 2 hours per 
response) at a cost of $37,101,400 
(742,028 hours x $50 per hour). 

In addition, we estimate that 80 
percent of Medicaid providers also 
participate in Medicare, and thus would 
have provider screening activities 
performed by the Medicare contractors. 
Thus, we estimate that States would be 
required to conduct provider screening 
activities for 74,203 (371,014 X 20 
percent) re-enrolling Medicaid-only 
providers each year. We further estimate 
that it will take States, on average, 4 
hours to perform the required provider 
screening activities — noting that 
currently enrolled providers would 
generally be categorized as lower risk 
than newly-enrolling providers. The 
estimated burden associated with this 
requirement for State Medicaid agencies 
is 296,812 hours (74,203 responses x 4 
hours per response) at a cost of 
$14,840,600 (296,812 hours x$50 per 
hour). We believe that the burden on 
States will be in large part offset by the 
application fees collected and by tlie 
Federal share for the amounts not 
covered by the application fee. 

The total estimate annual burden 
associated with the Medicaid 
prescreening requirement is 1,038,840 
hours at a cost of $51,942,000 
($37,101,400 -f $14,840,600). 


Table io— Estimated Annual Reporting/Recordkeeping Burden 


Regulation section(s) 

OMB 

Control 

No. 

Respond- 

ents 

Responses 

Burden per 
response 
(hours) 

Total an- 
nual bur- 
dert 
Piours) 

Hourly 
labor cost 
of 

reporting 

($) 

Total labor 
cost of 
reporling 

(S) 

Total 

capital/ 

mainte- 

nance 

costs 

($) 

Total cost 
(S) 

§424.514(0)” 

0938- 

12,000 

12,000 

1 

12.000 

50 

600,000 

0 

600,000 


0585; 










0936-1057 









§424.518(c){2)(b} and (d) 

0938-New 

35.000 

35.000 

2 

70,000 

50 

3,500,000 

0 

3,500,000 

§424.518(c)0)(iv) end (d) 

0938-New 

10,500 

10.500 

2 

21,000 

50 

1,050,000 

0 

1:050,000 

§455,434 

0g38-New 

26.000 

26,000 

2 

52.000 

50 

2,600,000 

0 

2,600,000 

§455.104 

0g38-New 

427,264 

427.264 

.033 

14,242 

50 

712,100 

0 

712,100 

§455-450 

0938-New 

5000 

5000 

B 

40.000 

50 

2,000,000 

0 

2.000,000 

§455.414 (Providers) 

0938-New 

371.014 

371.014 

2 

742,028 

50 

37,101,400 

0 

37,101,400 

§455.414 (State Medicaid Agencies) 

0938-New 

74,203 

74,203 

4 

296.812 

50 

14,840,600 


14,840,600 
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Table 10 — Estimated Annual Reporting/Recordkeeping Burden — C ontinued 


Regulation 5ection(s) 

OMB 

Control 

No. 

Respond- 

ents 

R^ponses 

Burden per 
response 
(hoixs) 

Total an- 
nual bur- 
den 
(hours) 

Hourly 
labor cost 
of 

reporting 

($) 

Total labor 
cost of 
reporting 

(S) 

Total 

capital/ 

mainte- 

nance 

costs 

($) 

Total cost 
($) 



960,981 

960.9B1 


1.248.082 




62,404,100 








" Denotes that we wil! be submitting revisions of the currently approved irrforrrtation collection requests for OMB review and approval. 


Comment.- A commenter requested 
clarification on whether the dollar 
figure of $62 million in Table 6 of the 
proposed rule (entitled “Estimated 
Annual Reporting/Recordkeeping 
Burden”) is the cost shared by the 
Federal Medicare programs as well as 
all of the State Medicaid agencies 
collectively. 

Response.- It includes Medicare costs, 
and those of the State Medicaid 
agencies. 

IV. Response to Comments 

Because of the large number of public 
comments we normally receive on 
Federal Register documents, we are not 
able to acknowledge or respond to them 
individually. We will consider all 
comments we receive by the date and 
time specified in the “DATES” section of 
this preamble, and, when we proceed 
with a subsequent document, we will 
respond to the comments in the 
preamble to that document. 

V. Regulatory Impact Analysis 
A. Statement of Need 

This final rule with comment period 
is needed to implement the following 
provisions of the ACA; (1) Section 
6401(a) and section 6401(b) of the ACA 
added section 1666(j)(2) to the Act and 
requires the establishment of screening 
procedures for providers and suppliers 
in the Medicare. Medicaid and CHIP 
programs: (2) section 6401(a) of the ACA 
added section 1866(j)(2)(C) to the Act 
and requires the establishment of 
application fees for institutional 
providers and suppliers; (3) section 
6401(a) of the ACA added a new section 
1866(j)(7) to the act establishing the use 
of temporary moratoria regarding the 
enrollment of providers and suppliers in 
Medicare, and section 6401(b)(1) of the 
ACA added a new section 1902(kk)(4) of 
the Act for a parallel requirement in the 
Medicaid and CHIP programs; (4) 
section 6501 of the ACA added section 
1902(a)(39) to the Act establishing 
guidance for States regarding the 
termination of providers from Medicaid 
and CHIP if terminated by Medicare or 
another Medicaid State plan or CHIP; 
and permitting guidance regarding the 
termination of providers and suppliers 


from Medicare if terminated by a 
Medicaid State agency; and (5) Section 
6402(h) of the ACA added 1862(o) to the 
Act establishing the requirements for 
the suspension of payments pending 
credible allegations of fraud in the 
Medicare and Medicaid programs. As 
previously explained, we believe these 
provisions are necessary to assist us in 
preventing fraud, waste and abuse in the 
Medicare, Medicaid and CHIP programs. 

B. Overall Impact 

We have examined the impact of this 
rule as required by Executive Order 
12866 on Regulatory Planning and 
Review (September 1993), the 
Regulatory Flexibility Act (RFA) 
(September 19, 1980, Pub. L. 96-354), 
section 1102(b) of the Social Security 
Act, section 202 of the Unfunded 
Mandates Reform Act of 1995 (Pub. L. 
104-4), Executive Order 13132 on 
Federalism (August 4, 1999), and the 
Congressional Review Act (U.S.C. 
e04(s)). 

Executive Order 12866 directs 
agencies to assess all costs and benefits 
of available regulatory alternatives and , 
if regulation is necessary, to select 
regulatory approaches that maximize 
net benefits (including potential 
economic, environmental, public health 
and safety effects, distributive impacts; 
and equity). A regulatory impact 
analysis (RIA) must be prepared for 
rules with economically significant 
effects ($100 million or more in any 1 
year). This final rule with comment 
period does reach the economic 
threshold and thus is considered an 
economically significant rule. 

TTie RFA requires agencies to analyze 
options for regulatory relief for small 
businesses. Under the RFA, we must 
either prepare an Initial Regulatory 
Flexibility Analysis or certify that the 
final rule with comment period will not 
have a significant impact on a 
substantial number of small entities. For 
purposes of the RFA, small entities 
include small businesses, nonprofit 
organizations, and government agencies. 
Most hospitals and most other providers 
and suppliers are small entities, either 
by nonprofit status or by having 
revenues of less than $7,0 to $34.5 
million (depending on provider type) in 


any one year, Individuals and States are 
not included in the definition of a small 
entity. We do not believe that our 
application fees will have a significant 
impact on any small entities. Likewise, 
we do not believe that other screening 
provisions, such as the provision of 
fingerprints or accommodating 
unannounced visits, will have a 
significant impact on any small entities. 
We believe this final rule with comment 
period could have significant impact on 
a relatively small proportion of small 
businesses in terms of restrictions on 
federal health monies paid to small 
businesses participating in the Medicare 
or Medicaid programs or CHIP. Clearly, 
imposition of an enrollment moratorium 
would have an impact on a small 
business that is attempting to do 
business with any of the Federal health 
programs. Similarly, suspension of 
payments to any small entity could 
create a significant impact on that 
entity. However, we have no basis for 
e.stimating how many entities might be 
affected by these provisions. Finally, we 
believe that this final rule with 
comment period will reduce fraud and 
abuse among potential providers. 

We believe there willbe a significant 
impact on their ability to defraud the 
taxpayer in several ways. First, closer 
screening of certain high-risk providers 
and suppliers will better enable CMS to 
detect those individuals and entities 
that pose a risk to the Medicare 
program. We expect that the prevention 
of unqualified providers and suppliers 
from enrolling in Medicare will protect 
the Medicare Trust Fund and save the 
taxpayers millions of dollars. Second, 
the temporary moratoria provisions will 
enable CMS to restrict the entry of 
certain providers and suppliers into 
Medicare in order to prevent or combat 
fraud, waste, and abuse, thus, again, 
saving millions of Federal dollars. 

While we cannot quantify with 
exactitude the amount of money that the 
Medicare program will save as a result 
of these measures, we do believe that 
the figure will exceed the costs outlined 
in this RIA. We solicited comment on 
the overall proposed screening 
processes of the proposed rule, 
including how the risk of fraud is 
determined, the administrative 
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interventions proposed to address the 
risk, and the criteria for exceptions to 
the enrollment application fee and any 
temporary enrollment moratoria. We 
requested that small businesses 
comment on these provisions and offer 
suggestions about how to mitigate what 
they might see as adverse administrative 
or financial impacts, This RIA, taken 
together with the remainder of the 
preamble, constitutes an Initial 
Regulatory Flexibility Analysis under 
the RFA. 

In addition, section 1102(b) of the Act 
requires us to prepare a regulatory 
impact analysis if a rule may have a 
significant impact on the operations of 
a substantial number of small rural 
hospitals. This analysis must conform to 
the provisions of section 604 of the 
RFA. For purposes of section 1102(b) of 
the Act, we define a small rural hospital 
as a hospital that is located outside of 
a Metropolitan Statistical Area and has 
fewer than 100 beds. We did not prepare 
an analysis for section 1102(b) of the 
Act because we have determined that 
this final rule with comment period will 
not have ? significant impact on the 
operations of a substantial number of 
small rural hospitals. 

Section 202 of the Unfunded 
Mandates Reform Act of 1995 also 
requires that agencies assess anticipated 
costs and benefits before issuing any 
rule that may result in expenditure in 
any 1 year by State, local, or tribal 
governments, in the aggregate, or by the 
private sector, of $135 million. This rule 
does mandate expenditures by State and 
local governments, in order to enforce 
the Medicaid-related provisions, but we 
believe that those expenditures will be 
relatively minor. The mandated costs on 
providers — primarily for application 
fees — may approach or exceed the 
threshold for the private sector. 
Accordingly, this RIA constitutes the 
required assessment of costs and 
benefits under UMRA. 

Executive Order 13132 establishes 
certain requirements that an agency 
must meet when it promulgates a 
proposed rule (and subsequent final 
rule) that imposes substantial direct 
requirement costs on State and local 
governments, preempts State law, or 
otherwise has Federalism implications. 
Since this final rule with comment 
period would not impose any 
substantial direct requirement costs on 
State or local governments, preempt 
State law, or otherwise have Federalism 
implication, the requirements of E.O. 
13132 are not applicable. 

We received several comments on the 
RIA. They are as follows; 

Comment: A commenter noted that, 
under the proposed rule. Medicare 


contractors will not begin processing an 
enrollment application until the 
application fee is received and credited 
to the United States TYeasury. The 
commenter recommended that CMS 
estimate the increase in enrollment 
application processing times due to the 
fee requirement and the impact this 
additional time will have on private 
sector. 

Response; It is not possible to qualify 
the additional time, if any, that this 
requirement would have on processing 
times. Moreover, we do not believe that 
a minor delay in processing would 
result in any quantifiable and definable 
monetary cost to a particular provider. 

Comment; Several commenters 
contended that CMS did not comply 
with section 6(a){3){C){i) of Executive 
Order 12866. Specifically, CMS: (l) Did 
not include an assessment or 
quantification of benefits associated 
from this regulatory action; ( 2 ) the 
underlying analysis of the costs and 
benefits of potentially effective and 
reasonably feasible alternatives to the 
planned regulation; (3) explain why the 
planned regulatory action is preferable 
to the identified potential alternatives; 
(4) include any feasible alternatives to 
the planned screening process: (5) 
include alternatives to the payment 
suspension portions; (6) include the cost 
impact on health care providers due to 
increased processing times; (7) solicit 
comments on or consider the costs or 
benefits of reasonably feasible 
alternatives, such as assessing the 
application fee by NPl or TIN or 
assessing the risk based on as past 
experience with the Medicare program 
or other health plans; or (8) consider the 
Medicare error rate in determining the 
category of risk. The commenter stated 
that CMS should therefore not finalize 
the provisions of this proposed rule 
until a new proposed rule is published. 

Response: The proposed rule and the 
final rule with comment period both 
contain a Regulatory Impact Analysis as 
required by Executive Order 12866, As 
explained in section IV.E. and 
throughout this final rule with comment 
period, we believe that this regulation 
will have a significant benefit by 
reducing the ability of potential 
providers to defraud taxpayers. The 
proposed rule solicited comments on 
the proposed screening categories, on 
the use of fingerprinting and other 
alternatives to identity verification, on 
the kind of documentation that must be 
submitted to assert a hardship exception 
to the application fee, an alternative 
definition of the term “resolution of an 
investigation,” on criteria that would 
justify the reclassification of a provider 
from one risk category to another, on the 


applicability of geography in the 
determination of a risk category, and on 
additional triggers that would move a 
provider into a different risk category. 

We did not believe the use ofNPIs or 
TINs in the assessment of the 
application fee was appropriate because 
the requirement to submit an enrollment 
application is separate from the 
requirement to have an NPI or a TIN. 

We believe that basing the fee on the 
submission of an application is most 
consistent with the statute. With respect 
to the Medicare error rate, an 
erroneously paid claim does not 
necessarily mean that the claim was 
fraudulently submitted. For this reason, 
we believe it would be improper to use 
it in our placement of providers into 
risk categories when there were other 
factors — including comprehensive 
studies of fraudulent behavior, such as 
OIG and GAO reports — that were more 
conclusive. We have solicited comments 
on proposals and potential alternatives, 
and have considered such comments in 
the development oftliis final rale with 
comment period. 

Comment; A commenter stated that 
the proposed rule contained a number 
of internal inconsistencies between the 
preamble and regnlation impact 
statement, such as: (1) use of 2.34 
percent as the CPI in preamble and 3.0 
percent as the CPI in the regulation 
impact section; (2) the lack of an 
“Alternatives Considered” section in the 
regulation impact section, and (3) a 
failure to account for the cost or impact 
of the additional off-cycle revalidations 
in the regulation impact section. The 
commenter recommended that CMS 
publish a new proposed rule. 

Response: The use of 2,34 percent in 
the preamble was simply for lllustrativo 
purposes. Having said that we have 
revised the 3 percent figure to more 
accurately reflect actual and projected 
CPI-U statistics we have received. 
Specifically, the rates we used for 2031, 
2012, 2013, 2014 and 2015 are, 
respectively, 3.0 percent, 2.0 percent, 

2.0 percent, 2.0 percent and 2.0 percent. 
The figure for 2031 is based on data 
obtained from the Bureau of Labor 
Statistics, while the data for years 2012 
through 2015 represent the estimated 
CPI-U figures offered in the Budget of 
the U.S. Government. Fiscal Year 2011, 
The CPI-U figures reflect the percentage 
change in the consumer price index for 
all urban consumers (all items; United 
States city average), for the 12-month 
period ending with June of the previous 
year. Moreover, we have added an 
“Alternative Considered” section to the 
RIA. 

As stated previously, we solicited 
comments on multiple issues in the 
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proposed rule. Additionally, we are 
implementing provisions of the ACA 
that had already outlined certain 
requirements for the regulations. The 
ACA, for example, required that we 
determine the level of screening to be 
conducted with respect to the category 
of provider or supplier, to require an 
application fee of $500 adjusted after 
2010 for the consumer price index, and 
to suspend payments pending an 
investigation of credible allegations of 
fraud. 

The RIA took into account the cost of 
revalidations beginning on March 25, 
2011, prior to the date at which CMS 
conid begin off-cycle validations under 
§ 424.515(e), but the same date at which 
the new screening requirements will go 
into effect. Any provider validated after 
March 25, 2011 but before March 23, 

201 2 will not be subject to off-cycle 
revalidation and any provider that is 
revalidated will begin a new cycle of 
revalidation requirements. Therefore, 
any off-cycle revalidations that occur 
after March 23, 2012 will restart the 
revalidation cycle, and only DMEPOS 
suppliers who are on 3 year validations 
will be revalidated, in cycle, prior to the 
end of CY 201 5. We believe the RIA is 
valid. 

Comment: A commenter noted that, 
under the proposed rule, Medicare 
contractors will not begin processing an 
enrollment application until the 
application fee is received and credited 
to the United States Treasury. The 
commenter recommended that CMS 
estimate the increase in enrollment 
application processing times due to the 
fee requirement and the impact this 
additional time will have on private 
sector. 

Response; It is not possible to qualify 
the additional time, if any, that this 
requirement would have on processing 
times. Moreover, we do not believe that 
a minor delay in processing would 
result in any quantifiable and definable 
monetary cost to a particular provider. 

Comment: One commenter stated that 
the preamble of this proposed regulation 
uses 2.34 percent as the Consumer Price 
Index (CPI) for the application fee, 
while the regulatory impact section uses 
3 percent as the CPI for the application 
fee. The commenter recommended that 
CMS: (l) Use the official percentage by 
the Bureau of Labor Statistics in 
calculating the change in application fee 
year by year, (2) explain if a negative 
CPI will result in a decrease in the 
application fee, and (3) use the actual 
CPI for 2010 in developing the final rule 
with comment period and establishing 
the application fee that must bo paid by 
providers and suppliers in 2011 . 


Response: We agree and, as 
previously explained, have incorporated 
more accurate CPI-U rates into this final 
rule with comment period. A negative 
CPI would result in a fee decrease; 
however, the RIA projects a continued 
increase in the CPI. 

Comment; A commenter noted that 
CMS states in the RIA that 400,000 
providers and suppliers would need to 
revalidate their enrollment over a 5 year 
period. However, CMS excluded groups 
and clinics irom the impact of the 
application fee. The commenter did not 
believe there are 400,000 providers and 
suppliers to revalidate, since a large 
number of providers and suppliers are 
designated as medical groups/clinics. 
The commenter recommended that CMS 
furnish a breakdown of the providers 
and suppliers that would be required to 
revalidate their enrollment in Medicare 
and adjust, if necessary, the amount 
collected via the application fee. The 
commenter also suggested that CMS 
provide the number of providers and 
suppliers by year that were subject to 
revalidation since 2006. 

Response; We do not believe that a 
specific breakdown by provider type 
and year is necessary, and maintain our 
view that approximately 400,000 
provideis and suppliers will revalidate 
their enrollment over a 5 year period- 
even accounting for medical groups/ 
clinics. This figure, admittedly, may be 
a little high, but we would prefer to 
overestimate the potential burden than 
underestimate It. 

In light of these comments, we have 
revised our calculations based on new 
and more accurate CPI-U rates and have 
added an “Alternative Considered” 
section. 

C. Anticipated Effects 
1, Medicare 

8. Enhanced Screening Procedures — 
Medicare 

Based on statistics obtained from 
PECOS and our Medicare contractors, 
there are approximately 400.000 
providers and suppliers currently 
enrolled in the Medicare program. (This 
does not include eligible professionals.) 
This figure includes ambulance service 
suppliers; ambulatory surgical centers; 
community mental health centers; 
comprehensive outpatient rehabilitation 
facilities; suppliers of DMEPOS; end- 
stage renal disease facilities; federally 
qualified health centers; 
histocompatibility laboratories; home 
health agencies; hospices; hospitals, 
including physician-owned specialty 
hospitals; critical access hospitals; 
independent clinical laboratories; 
independent diagnostic testing facilities; 


Indian health service facilities; 
mammography centers: mass 
immunizers (roster billers); medical 
groups/clinics, including single and 
multi-specialty clinics; organ 
procurement organizations: outpatient 
physical therapy/occupational therapy/ 
speech pathology services; portable x- 
ray suppliers; skilled nursing facilities; 
radiation therapy centers; religious non- 
medical health care institutions; and 
rural health clinics. We note the 
following in section III. of this final rule 
with comment period; 

• Based on 2009 experience we 
estimated that there will be 7, 000 
DMEPOS suppliers and HHAs that will 
submit an application to become a new 
Medicare enrolled provider in 2011. We 
would require approximately 35, 000 
individuals (7, ODD providers/suppliers x 
5 individuals per applicant) to undergo 
fingerprinting to participate in the 
Medicare program as an owner of an 
HHA or supplier of DMEPOS. We have 
found that the cost of having a set (two 
prints) of fingerprints done through law 
enforcement is approximately $50.00 
per individual. (This includes the time 
spent in obtaining the fingerprints.) The 
cost of this fingerprinting requirement 
would therefore be $1.75 million per 
year (35,000 individuals x $50). 

• We estimated that 10,000 
individuals (2.000 providers or 
suppliers x 5 individuals per applicant) 
would undergo fingerprinting following 
the lifting of a moratorium on a 
particular provider or supplier type, at 

a cost of $500,000 per year (10,000 x 
$50). Should requests be made of 5,000 
providers or suppliers, tlie annual figure 
would be $1,250,000 (5,000 x 5 
individuals per applicant x $50). Should 
requests be made of 10,000 providers or 
suppliers, the annual figure would be 
$2.5 million (10.000 x 5 x $50). 

• We estimate that 500 physicians 
would undergo fingerprinting per year, 
at a cost of $25,000. 

This results in a total cost of the 
fingerprinting requirement of 
$2,275,000 per year ($1,750,000 + 
$500,000 + $25,000), or $11,375,000 
over 5 years. If 5.000 post-moratorium 
requests are made, the annual cost is 
$3,025,000, with a 5 year cost of 
$15,125,000. Should 10,000 post- 
moratorium requests be made, the 
annual cost is $4,275,000, with a 5 year 
cost of $21,375,000. 

As we believe that 2,000 post- 
moratorium requests is the most likely 
scenario, we will hereafter use the 
$2,275,000 amount as the annual cost of 
this requirement. This results in an 
estimated 5 year cost of $11,375,000. 
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b, Application Fee — Medicare 

The Secretary shall impose an 
application fee on each institutional 
provider. The amount of the fee is $500 
per provider or supplier for 2010. For 
2011 and each subsequent year, the fee 
amount w'ill be determined by the 
statutorily required formula using the 
consumer price index for all urban 
consumers (CPI-U). The enrollment 
application fee does not apply to 
individual eligible professionals (for 
example, physicians). The fee is to be 
paid by institutional providers only. 

The new screening provisions are 
applicable to new and revalidating 
providers and suppliers effective March 
25, 2011, and to currently enrolled 
providers and suppliers as of March 23, 
2012. We will to begin collecting the 
enrollment application fee for new 
providers and suppliers and for 
currently enrolled providers 
revalidating enrollment effective March 
25, 2011. 


c. General Enrollment Framework 
(l) New Enrollment 

Medicare contractors report that over 
the last several years, approximately 
32,000 is the annual number of newly 
enrolling providers and suppliers that 
would — without accounting for the 
possible granting of waivers — ^be subject 
to the enrollment application fee — 
{approximately 20,000 for Medicare Part 
B, approximately 7,000 DMEPOS 
suppliers and HHAs (as explained in the 
Collection of Information section), and 
approximately 5,000 non-HHA 
Medicare Part A providers).^ 

We assumed that no more than 2.S 
percent of these 32,000 providers and 
suppliers — or 800 — will receive a 
hardship exception; as indicated earlier, 
exceptions will only be approved 
infrequently. 

In CY 2011, we reduced the estimate 
number of institutional providers 
subject to the application fee by 25 
percent because the application fee will 
not begin until March 25, 2011. 
Accordingly, the number of institutional 
providers that we anticipate paying the 
application fee will be 23,400 (or 31,200 


X ,75) in CY 2011. Therefore, the 
impacts of the enrollment application 
fee are as follows. If we use 23,400 as 
the number of newly enrolling providers 
and suppliers in 2011 and multiply this 
number by an application fee of $505 (or 
$500 X 1,0 percent), we get $ 11,617,000 
collected for the first year (that is, CY 
201 1). If we assume that the number of 
newly enrolling providers and suppliers 
will reifiain constant at 31,200 for years 
2012 through 2015, the cost to the 
number of newly enrolling providers 
and suppliers would be $78,054,600. 
Although we have no way to predict 
that the number of new enrollments will 
change in future years, it is possible that 
the number of enrolling providers and 
suppliers vary from what has been the 
norm. If our estimate of the number of 
newly enrolling providers is inaccurate 
and we enroll a different number of 
providers and suppliers after the 
effective date of the new screening and 
other provisions contained in the ACA, 
we estimate based on the $500 
enrollment application fee — a rough 
difference of $1 million for each 
increment of 2,000 new enrollments, 
whether fewer or greater. 


Table 11 — Cumulative Application Fees for Newly Enrolling medicare Providers and Suppliers for the 
First 5 Years of the Provision 


Calendar year 

Newly enrolling 
institutional 
providers and 
suppliers 

Newly enrolling tn- 
stilutionaf 
providers and 
suppliers paying 
the application fee 
(based on a 2.5% 
hardship excep- 
tion rate) 

CPl-U ifKrease 
(%) 

Consumer price 
index adjusted 
fee in dollars ' 

Total fees for 
each year in 
dollars 

Cumulative fees 
in dollars 

2011 

24,000 

23,400 

1.0 

505 

11,817,000 

11,817,000 

2012 

32,000 

31,200 

2.0 

515 

16,068,000 

27,885,000 

2013 

32,000 

31,200 

2.0 

525 

16,380,000 

44,265,000 

2014 

32.000 

31,200 

2.0 

536 

16,723,200 

60,988,200 

2015 

32,000 

31,200 

2.0 

547 

17,066,400 

78,054.600 

Total 





78,054,600 

78,054,600 


*As already mentioned, section 6401(a)(3) of the ACA called for a $500 application fee for institirtionai providers in 2010. Since the effective 
date of this final rule with comment period is March 25. 2011, we have added a 1.0 percent increase to the S500 fee for 2011. Moreover, each 
fee amount in this category was rounded up to the nearest dollar. 


(2) Revalidation 

There are approximately 100, □□□ 
currently enrolled suppliers of DMEPOS 
who are required to revalidate their 
enrollment every 3 years and 300,000 
additional providers and suppliers that 
do not provide DMEPOS that are 
required to revalidate their enrollment 
every 5 years, On a yearly basis, we 
estimate that approximately 33,000 
DMEPOS suppliers (one-third of the 
total) and 60,000 other, non-DMEPOS 
providers/suppiiers (one-fifth of the 


'For purposes of the calculations in this RIA. 
newly-enrolling Medicare providers and suppliers 


total) would revalidate their enrollment 
in Medicare, for an annual total of 
93,000. Since, as explained earlier, we 
estimate that no more than 2.5 percent 
of these providers and suppliers will 
receive a waiver from the application 
fee, we project that 90,675 such 
providers and suppliers will be subject 
to the fee. 

This final rule with comment period - 
contemplates collecting the application 
fee for currently emolied providers that 
revalidate their enrollment on or after 


include those that ware once enrolled, departed, 
an d are now seeking to enroll again. 


March 25, 2011 — almost 3 months into 
CY 2011. Therefore, we have adjusted 
the number of existing Medicare 
institutional providers subject to an 
application fee by 25 percent, from 
90,675 to 68,006 (or 90,675 X .75) in CY 
2011. With respect to the period 
between CY 2012 and 2015, it is 
possible that, as previously alluded to in 
the preemble, we may perform an 
elevated number of revalidations early 
in this 4* year timeframe — specifically, 
in CY 2012. This would be done 
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pursuant to our authority under 
§ 424.515(e) to require off-cycle 
revalidations. We cannot say for certain 
how many will be performed in CY 
2012. For purposes of this RIA only, 
however, we will estimate that 111,000 

Table 12— Cumulative Application 


will be conducted in CY 2012, with 

87,000 performed in each of the 
remaining 3 years. Further accounting 
for projected annual CPI-U rate 
increases, we estimate that the cost 
associated with these fees for 


revalidating providers and suppliers 
would be approximately $226,477,505 
over the first 5 years that the ACA 
provisions are in effect, as shown in 
Table 12. 


Fees for Revalidating Medicare Providers and Suppliers for the First 5 
Years of the Provision 


Calendar year 

Revalidating 
institutional 
providers and 
suppliers 

Revalidating 
institutional 
providers & 
suppliers paying 
application fee 
(based on 2.5% 
hardship 
exception rate) 

CPI-U increase 

Consumer price 
index adjusted 
fee in dollars 

Total fees for 
each year 
(in dollars) 

Cumulative fees 
(in dollars) 

2011 

69,750 

68,006 

1.0% 

505 

34,343,030 

34,343,030 

2012 .. 

111,000 

1 08,225 

2.0% 

515 

55,735,875 

90,078.905 

2013 

87,000 

84,825 

2.0% 

525 

44,533,125 

134,612,030 

2014 .. 

87,000 

84,825 

2.0% 

536 

45,466,200 

180,078,230 

2015 .. 

87,000 

84,825 

2.0% 

547 

46,399,275 

226,477,505 






226,477.505 

226,477,505 







Therefore, we estimate that the total 
impact of the provisions for the 
application fee to be approximately 
$304,532,105 over the next 5 years. This 
number was approximated by adding 
the cumulative application fees for 
newly enrolling providers and suppliers 
($78,054,600 as shown in Table 11) to 
the cumulative application fees for 
revalidating providers and suppliers 
($226,477,505). 

2. Medicaid 

a. Enhanced Screening Procedures 

Although our data on Medicaid 
provider enrollment at the national level 
Is very limited, we do collect annual 
data on State Medicaid program 
integrity activities. This annual data 
collection, known as the State Program 
Integrity Assessment (SPIA) program, 
consists of self-reported data by States 
regarding a variety of program integrity 
related activities. The information is 
self-reported and has not been 
Independently verified by CMS, and it 
undoubtedly represents some unknown 
degree of duplication among providers 
across States. Consequently, the 
estimated number of Medicaid 
providers nationally is likely overstated. 
According to SPIA data for FFYs 2007 
and 2008, there has been an average of 
1 ,855,070 existing Medicaid providers 
nationally over the 2-year period of FFY 
2007 and FFY 2008, This universe of 
Medicaid providers includes all 
provider types, both institutional 
providers and individual practitioners. 

In the Medicare program, eligible 
practitioners make up approximately 70 
percent of the total universe of 


providers, suppliers, and eligible 
practitioners. Because we do not have 
detailed information regarding the 
breakdown of Medicaid providers by 
type nationally, we will apply the same 
ratio to determine the percentage of 
institutional Medicaid providers. 
Therefore, we estimate that there are 
approximately 556,521 Medicaid-only 
providers nationally that are not 
individual practitioners. 

We also estimate almost all CHIP 
providers are also Medicaid providers. 
So, for purposes of this section, we are 
considering CHIP providers to also be 
Medicaid providers and will 
subsequently refer to them only as 
Medicaid providers. 

As previously stated in the Medicare 
section of the analysis, we estimated 
that we would require the following; 

• Approximately 35,000 individuals 
will undergo fingerprinting to enroll in 
the Medicare program as owners, of a 
home health agency or supplier of 
DMEPOS. Based on data collected as 
part of the State survey and certification 
activities for home health agencies, less 
than 1 percent of home health agencies 
are Medicaid-only. And. although there 
is no data available on the number of 
Medicaid-only suppliers of DMEPOS, 
we estimated that the number is 
minimal as well, as a number of States 
require suppliers of DMEPOS to be 
enrolled in Medicare prior to enrolling 
in Medicaid, Therefore, we estimated 
that States may require approximately 

1,000 additional individuals with 
ownership interests in suppliers of 
DMEPOS or home health agencies, to 
undergo fingerprinting for etu-ollment in 
the Medicaid program. The cost of this 


fingerprinting requirement would be 
approximately $50,000 (1,000 x $50 = 
$50,000), though we solicited comments 
on the accuracy of this figure. 

• We anticipated that Medicare 
contractors will perform the screening 
activities for the overwhelming majority 
of providers following the lifting of a 
Secretary-imposed temporary 
moratorium and for the limited 
circumstances in which physicians may 
be fingerprinted. However, given that 
States may also classify certain 
Medicaid-only providers as "high” 
categorical risks, we are estimating that 
States may require approximately 

25,000 additional individuals to 
undergo fingerprinting prior to enrolling 
in a State’s Medicaid program, at a cost 
of $1,250,000 (25,000 x $50 = 
$1,250,000), 

Consequently, we estimated that 
fingerprinting individuals for purposes 
of Medicaid enrollment will cost 
$1,300,000. When averaged across 50 
States, the District of Columbia and 
Puerto Rico, the annual cost of 
fingerprinting per State will be $26,000. 

b. Application Fee — Medicaid 

For those providers not screened by 
Medicare, the State may impose a fee on 
each institutional provider being 
screened. The amount of the fee is $500 
per provider for 2010. For 2011 and 
each subsequent year, the amount will 
be determined by the statutorily- 
required formula using the consumer 
price index for all urban consumers 
(CPl-U). 
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c. General Enrollment Framework 
For purposes of this section, we 
assume that 80 percent of institutional 
Medicaid providers will be dually 
participating in both Medicare and 
Medicaid, and thus will be subject to 
the application fee as part of the 
Medicare screening and enrollment. 
Therefore we estimated that 20 percent, 
or 111,304 (556,521 X 20 percent), of the 
institutional Medicaid-only providers 
will not be screened by Medicare and 
thus will be subject to the application 
fee under Medicaid, We project that a 
significant number of existing and 
future Medicaid providers will request a 
hardship exception, or that a State will 
request a waiver of the application fee 
for certain Medicaid provider types of 
the application fee on the basis of 
ensuring access to care. For purposes of 
this section, although we have no way 
to estimate the exact number of 
providers that will ultimately request 
and be approved for a hardship 
exception, or the number of States that 
will request a waiver of the fee for 
certain Medicaid provider types, we 
predict that 25 percent of all Medicaid 
providers subject to the fee will receive 
the hardship exception or be granted a 
waiver of the fee on the basis of 


ensuring beneficiary access to care. We 
recognize that this 25 percent figure is 
significantly higher than the 2.5 percent 
waiver rate we are using for Medicare 
application fees. Yet we believe the 
difference is justified because of the 
greater access to care issues that may 
arise in Medicaid. Consequently, we 
estimated that 83,478 existing Medicaid 
providers will be required to pay the 
application fee (111,304 existing 
Medicaid providers that are not dually 
enrolled less 25 percent or 27,026 
existing providers). 

(1) New Enrollments 

We apply the 80 percent rate for 
newly-enrolling Medicaid institutional 
providers that will be dually 
participating in both Medicare and 
Medicaid and thus not subject to the fee 
under Medicaid, and 25 percent 
hardship exception rate to the annua] 
number of newly-enrolling Medicaid 
institutional providers not dually 
enrolled. The 45,000 newly-enrolling 
Medicare institutional providers 
annually represent 80 percent of the 
total newly-enrolling Medicaid 
institutional providers annually. 
Therefore, we estimate that there will be 
11,250 newly-enrolling Medicaid 


institutional providers annually that are 
subject to the application fee under 
Medicaid (45,000 providers divided by 
80 percent, - 45,000 = 11,250). We 
project another 25 percent will be 
exempted for hardship or be granted a 
waiver of the fee on the basis of 
ensuring beneficiary access to care, 
resulting in 0,438 newly-enrolling 
Medicaid institutional providers being 
subject to the application fee each year 
nationally. 

Consistent with the Medicare 
analysis, in CY 2011, we reduced the 
estimated number of institutional 
providers subject to the application fee 
by 25 percent because the application 
fee will not begin until March 25, 2011. 
Accordingly, the number of institutional 
providers that we anticipate paying the 
application fee will be 6,329 in CY 
2011. Consequently, we projected the 
dollars due from application fees for 
newly-enrolling Medicaid institutional 
providers who are not dually enrolled to 
be $21,110,019 for the first 5 years in 
total. When averaged across 50 States, 
the District of Columbia and Puerto 
Rico, the total application fees for the 5 
years in total per State will be 
approximately $405,962. 


Table 13— Cumulative Application Fees for Newly Enrolled medicaid Providers for the First 5 Years of 

THE Provision 


Calendar year 

New Medicaid 
providers not ex- 
; empted from the 
application fee 

1 CPI-U increase 

Consumer price 
index adjusted 
fee 

(in dollars) 

Total fees for 
each year 
(In dollars) 

CumulaUve fees 
(in dollars) 

2011 

6,329 

1.0% 

505 

3,196,145 

3,196,145 

2012 .. 

6,436 

2.01.1% 

515 

4,345,570 

7,541,715 

2013 . 

6,436 

2.0% 

525 

4,429,950 

11,971.665 

2014 . 

6,436 

2.0% 

536 

4,522,766 

16,494,433 

2015 . 

6,438 

2.0% 

547 

4,615,566 

21,110,019 





21,110,019 j 

21,110,019 






(2) Re-enrollment 

This rule contemplates that States 
would require Medicaid providers to re- 
enroll every 5 years. On a yearly basis, 
we estimate that approximately 16,696 
Medicaid institutional providers (one 
fifth of the total) would re-enroil with 
the State Medicaid agency. We 
contemplate collecting the application 

Table 14— Cumuutive Application 


fee for currently enrolled providers 
beginning on March 24, 2011. States 
would not collect an applicetion fee 
with any re-enrollments until that 
time — almost 3 months into CY 2011. 
Therefore, we have adjusted the number 
of existing Medicaid institutional 
providers subject to an application fee 
by 25 percent, from 16,696 to 12,522 in 
CY 2011. Consequently, we project the 


dollars due from application fees for 
currently-enrolled Medicaid 
institutional providers who are not 
dually enrolled is $41,769,218 for the 
first 5 years in total. When averaged 
across 50 States, the District of 
Columbia and Puerto Rico, the total 
application fees for the 5 years in total 
per State will be approximately 
$803,254. 


Fees for Re-Enrolling medicaid Providers for the First 5 Years of the 
Provision 


Calendar year 

Existing Medicsd ! 
providers ncH ex- : 
empted from the \ 
application fee 

CPI-U irtcrease 

Consumer price 
index adjusted 
fee in dollars 

Total fees for 
each year in 
dollars 

Cumulative fees in 
dollars 

2011 

12,522 ' 

1.0% 

505 

6.323.610 

6,323,610 
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Table 14 — Cumulative Application Fees for Re-Enrolling Medicaid Providers for the First 5 Years of the 

Provision — C ontinued 


Calendar year 

: Existing Medicaid 
providers not ex- 
I empted from the 
application fee 

CPMJ increase 

Consumer price 
index adjusted 
fee in dollars 

Total fees for 
each year in 
dollars 

Cumulative fees in 
dollars 

2012 

16,696 

2.0% 

515 : 

8,598,440 

14,922,050 

2013 

16,696 

2.0% 

525 

8,765,400 

23,687,450 

2014 

16,696 

2.0% 

536 

8,949,056 

32,636,506 

2015 

16,696 

2.0% 

547 

9,132,712 

41,769,218 





41,769,218 

41,769.218 






3. Medicare and Medicaid 

a. Moratoria on Enrollment of New 
Medicare Providers and Suppliers and 
Medicaid Providers 

Although we have no way of 
predicting the exact cost savings 
associated with enrollment moratoria. 
we expect there will be program savings 
achieved by implementation of this 
section. As stated previously, these 
provisions will enable us to restrict the 
entry of certain providers and suppliers 
into Medicare in order to prevent or 
combat fraud, waste, and abuse. 
However, there are no cost burdens to 
the public or to the provider 
community. Therefore, we have not 
estimated the cost impacts of this 
provision, 

b. Suspension of Payments in Medicare 
and Medicaid 

As with payment moratoria, although 
we have no way of predicting the exact 
cost savings to Medicare and Medicaid 
associated with implementation of the 
provisions contained in this final rule 
with comment period, we certainly 
expect that there will be program 
savings that result from implementation 
of this provision. CMS and its law 
enforcement partners already have a 
process for payment suspension when 
possible fraud is involved. The changes 
finalized in this rule will strengthen the 
existing process and its applicability to 
Medicaid, but it will not create any 
different impact or burden on the 
provider community in circumstances 
of payment suspension. There are no 
new cost burdens to the public or the 
provider community associated with 
this provision. 

D. Accounting Statement and Table 

As required by 0MB Circular A-4 
(available at bttp://www.whitehouse. 
gov/sites/default/files/omb/assets/omb/ 
circulars/a004/a-4.pdf), we have 


prepared an accounting statement. This 
statement only addresses: (!) The costs 
of the fingerprinting requirement, and 
(2) the monetary transfer associated 
with the application fee. It does not 
address the potential financial benefits 
of these two requirements from the 
standpoint of their possible 
effectiveness in deterring certain 
unscrupulous providers and suppliers 
from enrolling in or maintaining their . 
enrollment in Medicare and Medicaid. 
This is because it is impossible for us to 
quantify these benefits in monetary 
terms. Moreover, we cannot predict how 
many potentially fraudulent providers 
and suppliers will be kept out of the 
Medicare and Medicaid programs due to 
these requirements. 

1. Medicare 

As stated previously, we estimate a 
total cost of the fingerprinting 
requirement of $2,275,000 per year 
($1,750,000 + $500,000 + $25,000), or 
$11,375,000 over 5 years, if 2.000 post- 
moratorium requests are made. If 5,000 
post-moratorium requests are made, the 
annual cost is $3,025,000, with a 5 year 
cost of $15,125,000. Should 10,000 post- 
moratorium requests be made, the 
annual cost is $4,275,000, with a 5 year 
cost of $21, 375,000. We also stated in 
the RIA that the expected total 
application fees: 

• For newly enrolling providers and 
suppliers would be $11,817,000 in 2011, 
$16,068,000 in 2012, $16,380,000 in 
2013, $16,723,200 in 2014, and 
$17,066,400 in 2015. This results in a 5 
year total of $78,054,600. 

• For revalidating providers and 
suppliers would be $34,343,030 in 2011, 
$55,735,875 in 2012, $44,533,125 in 
2013, $45,466,200 in 2014, and 
$46,399,275 in 2015. This results in a 5- 
year total of $226,477,505. 

The accounting statement reflects the: 
(1) Annual cost of the fingerprinting 


requirement, and (2) the application of 
the 3 percent and 7 percent discount 
rate to the combined amounts of the 
application fees for CY 2012 — that is, 
$16,068,000 {newly enrolling) plus 
$55,735,875 (revalidations), for a total of 
$71,803,875; this constitutes a transfer 
of funds to the Federal government. We 
chose the CY 2012 figures so as to 
reflect the maximum amount of 
transferred funds in a given year during 
the initial 5-year period. 

2. Medicaid 

As stated in the RIA, we estimate that 
the annual cost of the fingerprint 
requirement for Medicaid will be 
$1,300,000, or $6,500,000 over a 5 year 
period. We also stated in the RIA that 
the expected total application fees: 

• For newly enrolling providers and 
suppliers would be $3,196,145 in 2011, 
$4,345,570 in 2012, $4,429,950 in 2013, 
$4,522,768 in 2014, and $4,615,586 in 
2015. This results in a 5-year total of 
$21,110,019. 

• For revalidating providers and 
suppliers would be $6,323,610 in 2011; 
$8,598,440 in 2012; $8,765,400 in 2013; 
$8,949,056 in 2014; and $9,132,712 in 
2015. This results in a 5-year total of 
$41,769,216. 

The accounting statement reflects: 

(1) The annual cost of the fingerprinting 
requirement: And (2) the application of 
the 3 percent and 7 percent discount 
rate to the combined amounts of the 
application fees for CY 2015 — 
specifically, $4,615,586 (new 
applicants) plus $9,132,712 
(revalidations), for a total of 
$13,748,296. This constitutes a transfer 
of funds to the Federal government. We 
chose the figures from CY 2015 for 
Medicaid so as to reflect the maximum 
amount of transferred funds in a given 
year during the initial 5-year period. 
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Table 15 — Accounting Statement: Classification of Estimated Expendtures and Costs from CY 2011 to CY 

2015 (IN MiLUONS) 


Medicare Fingerprint Requirement 

COSTS 

Annualized Monetized Costs (2,000 post-moratorium requests) 

3 percent Discount Rate 
$2,275 

7 percent Discount Rate 
$2,275 

Annualized Monetized Costs (5,000 post-moratorium requests) 

$3,025 

$3,025 

Annualized Monetized Costs (10,000 post-moratorium requests) 

$4,275 

$4,275 

Who is Affected? 

Providers and Suppliers 

Medicare Application Fee 

TRANSFERS 

Annualized Monetized Transfers (through 2015) 

3 percent Discount Rate 
$48.2 

7 percent Discount Rate 
$47.3 

From Whom to Whom? 

Providers and Suppliers to Federal Government 

Medicaid Fingerprint Requirement 

COSTS 


3 percent Discount Rate 
$1.3 

7 percent Discount Rate 
$1-3 


Who is Affected? 

Providers and Suppliers 

Medicaid Application Fee 

TRANSFERS 

Annualized Monetized Costs 

3 percent Discount Rate 
$10.1 

7 percent Discount Rate 
$10.0 

From Whom to Whom? 

Providers and Suppliers t( 

j Federal Government 


1 BENEFITS 


OuatHative: The above-referenced requirements will; (1) Allow CMS to more closely screen providers and suppliers that pose risks to the Medi- 
care and Medicaid programs; (2) help offset the costs of administering the Me^care and Medicaid programs; (3) limit, via the impositkjn of 
moratoha. the entry of certain categories of providers and suppliers into Medicare if this is deemed necessary to protect the Medicare Trust 
Fund; and (4) suspend payments to certain providers arKt suppliers that pose a risk to the Trust Fund. We believe these and other financial 
benefits outlined in this njle will exceed the costs outlined above. 


E. Alternatives Considered 

1. General Burden Minimization Efforts 

The RFA requires agencies to analyze 
options for the regulatory relief of small 
entities. In compliance with section 604 
of the RFA, we have incorporated 
several options designed to minimize 
the burden of the requirements in this 
final rule with comment period. 

First, we have waived the application 
fee for individual physicians, non- 
physician practitioners, and physician 
and non-physician practitioner groups, 
which are generally small businesses. 
We believe this is consistent with 
congressional intention as expressed in 
section 6401(a) of ACA, We also believe 
this will ease the financial burden on 
this large category of small businesses. 

Second, the high-risk category is 
limited to relatively few types of 
providers and suppliers. We could have 
elected to include many more providers 
and supplier types within this category 
and, subsequently, subjected them to 
the enhanced screening requirements of 
fingerprint-based criminal background 


checks. However, in part so as not to 
overly burden these entities, many of 
which are small businesses, we chose to 
restrict the high-risk category to a 
limited number of provider types. 

2. Fingerprinting 

We received several comments 
proposing alternatives to fingerprinting 
as a screening mechanism. The two 
principal suggested alternatives were 
the submission of a: (1) U.S. or foreign 
passport:,and (2) copies of the 
individual’s Federal tax returns, 
However, we explained in the preamble, 
we are adopting fingerprint-based 
criminal background checks. 

There are several reasons for our 
decision to proceed with fingerprinting 
as opposed to passports and tax returns. 
First, we are, to a large extent, 
combining the fingerprinting and 
criminal background check processes 
for providers and suppliers. These will 
be done though the FBI lAFlS, which 
we believe is the most reliable and 
appropriate avenue available. The 
submission of fingerprints is the only 


way to obtain a criminal history record 
check from the FBI lAFIS. Information 
from a U.S. or foreign passport or a 
Federal tax return, on the other hand, 
could only be used to process a name- 
based criminal history record check — 
and the FBI does not process name- 
based requests for non-criminal justice 
purposes. 

Second, we believe that 
fingerprinting — more than any other 
mechanism — will allow us to 
conclusively identify the individuals 
that will be participating in the 
Medicare program. Indeed, a tax return, 
while containing certain identifying 
information, does not — in our view — 
produce the level of assurance in this 
area that fingerprinting does. 

Finally, the use of passports or tax 
returns would require CMS to forgo the 
unified approach of the FBI lAFIS and 
instead have two separate processes — 
one for verifying identify and another 
for analyzing the person’s criminal 
history. This w'ould result in; (l) A 
verification process that is not as 
reliable as fingerprinting, and (2) a 
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distinct and potentially costly process 
for criminal background checks through 
private entities that, we believe, will 
probably not involve access to the scope 
of data that the FBI has. 

We believe that the overall costs 
involved in maintaining such a two-part 
approach would, in the end, exceed that 
of the FBI lAFIS approach, especially 
if — as we expect — the overwhelming 
majority of individuals subject to the 
fingerprinting requirement submit them 
electronically. Indeed, with respect to 
the cost differential between the paper 
and electronic fingerprinting processes, 
we stated earlier in the RIA that we 
estimate an average annual cost of the 
fingerprinting requirement of 
$2,275,000 (if 2,000 post-moratorium 
requests are made), based on; (l) The 
fingerprinting of 45,500 individuals; 
and (2) a $50 cost per person for 
obtaining a set of fingerprints via the 
FD-258. We believe that the per person 
cost for submitting fingerprints 
electronically will be approximately 
$35. If we assume that 40,000 of the 
45,500 individuals submit fingerprints 
electronically and the remaining 5,500 
use the FD-258, this results in an 
annual cost of $1,675,000, or $600,000 
less than $2,275,000. This leads to a 
savings over 5 years of $3,000,000 
($600,000 X 5). 

It is not possible for us to quantify the 
costs involved in having the FBI lAFIS 
perform the criminal background 
cKecks. However, we can estimate that 
it would coat approximately $40 per 
person to perform a criminal 
background check via private entities. 
This would result in an annual cost of 
$1,820,000, or $9,100,000 over 5 years. 
With the efficiency furnished through 
the use of the FBI-IAFIS, we do not 
believe the cost of these checks would 
ultimately exceed $9,100,000. 

We concede that the submission of a 
passport or tax return would not involve 
the processing costs that would come 
with fingerprinting. But the ability to 
verify one’s identity via fingerprinting 
is. we believe, sufficiently greater than 
with the latter two documents, such that 
the overall program integrity savings 
would substantially exceed any 
additional cost incurred in using 
fingerprints in lieu of passports and tax 
returns. 

3. Other Suggested Alternatives 

We received several other suggested 
alternatives to our proposed provisions. 
One was to assess the application fee 
based on the NPI or TIN. As stated 
earlier in this RIA. we did not believe 
this approach was appropriate because 
the requirement to submit an enrollment 
application is separate from the 


requirement to have an NPI or a TIN. 

We believe that basing the fee on the 
submission of an application is most 
consistent with the statute. Another 
involved taking into account factors 
such as; (l) Error rates; (2) past history 
with Medicare, Medicaid and other 
health plans; and (3) ownership, when 
assessing a provider or supplier's risk. 

In section U of this final rule with 
comment period, we stated that the 
ACA requires levels of screening 
according to the risk of fraud, waste, 
and abuse posed by categories of 
providers and suppliers as a whole. The 
approach taken in this final rule with 
comment period whereby we assign 
specific categories of providers and 
suppliers to screening levels determined 
by risk of fraud, waste, and abuse is 
consistent with the requirements of the 
statute. Therefore, in general, we chose 
to use a categorical approach to our 
classifications, rather than assign 
individual providers within a particular 
provider type to certain risk levels. 

F. Conclusion 

This final rule with comment period 
contains provisions that are of critical 
importance in the transition of CMS' 
antifraud activities from “pay and 
chase” to fraud prevention. “Pay and 
chase” refers to the traditional approach 
under which we met our obligations to 
provide beneficiaries access to qualified 
providers and suppliers and to pay 
claims quickly by making it relatively 
easy for providers to sign up to bill 
Medicare, Medicaid or CHIP, paying 
their claims rapidly, and then detecting 
overpayments or fraudulent bills and 
pursuing recoveries of overpayments 
after the fact. That system functions 
reasonably well when the problems 
arise with legitimate providers and 
suppliers that will be solvent and in 
business when CMS seeks to recover 
overpayments or law enforcement 
pursues civil or criminal penalties. It is 
not adequate when the fraud is 
committed by sham operations that 
provide no services or supplies and 
exist simply to steal from Medicare or 
Medicaid and thrive on stealing or 
subverting the identities of beneficiaries 
and providers- 

This final rule with comment period 
strikes a balance that wilt permit us to 
continue to assure that eligible 
beneficiaries receive appropriate 
services from qualified providers whose 
claims are paid on a timely basis while 
implementing enhanced measures to 
prevent outright fraud. The new and 
strengthened provisions in the ACA that 
are the subject of this final rule with 
comment period will help assure that 
only legitimate providers and suppliers 


are enrolled in Medicare, Medicaid, and 
CHIP, and that only legitimate claims 
will be paid. These provisions are 
applied according to the level of risk of 
fraud, waste, and abuse posed by 
different provider and supplier types. 

We will use screening tools for a 
particular provider or .supplier type 
based on 3 distinct categories of risk: (1) 
Limited; (2) moderate; and (3) high. 
Limited risk providers will have 
enrollment requirements, license and 
database verifications: moderate risk 
will have those verifications plus 
unscheduled site visits; high risk will 
have verifications, unscheduled site 
visits, criminal background check and 
fingerprinting. CMS and the States will 
impose moratoria on the enrollment of 
new providers in situations when doing 
so is necessary to protect against a high 
risk of fraud. Working in conjunction 
with the DIG, CMS and States will 
suspend payments pending an 
investigation of a credible allegation of 
fraud and legitimate providers will be 
assisted in avoiding problems by 
implementing effective compliance 
programs. 

This final rule with comment period 
is an essential tool in protecting public 
resources and assuring that they are 
devoted to providing health care rather 
than enriching fraudulent actors. 

In accordance with the provisions of 
Executive Order 1 2866, this regulation 
was reviewed by the Office of 
Management and Budget. 

List of Subjects 
42 CFH Part 405 

Administrative practice and 
procedure. Health facilities, Health 
professions, Kidney diseases, Medical 
devices, Medicare, Reporting and 
recordkeeping requirements, Rural 
areas, X-rays. 

42 CFR Part 424 

Emergency medical services, Health 
facilities, Health professions, Medicare, 
and Reporting and recordkeeping 
requirements. 

42 CFR Part 438 

Grant programs — 'health, Medicaid, 
Reporting and recordkeeping 
requirements. 

42 CFR Part 447 

Accounting, Administrative practice 
and procedure, Drugs, Grant programs — 
health, Health facilities, Health 
professions, Medicaid, Reporting and 
recordkeeping requirements, and Rural 
areas. 
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42 CFR Part 455 

Fraud, Grant programs — health, 

Health facilities, Health professions. 
Investigations, Medicaid, and Reporting 
and recordkeeping requirements. 

42 CFR Part 457 
Administrative practice and 
procedure, Grant programs — health, 
Health insurance, and Reporting and 
recordkeeping requirements- 

42 CFR Part 498 
Administrative practice and 
procedure. Health facilities, Health 
professions. Medicare, Reporting and 
recordkeeping requirements. 

42 CFR Part 1007 

Administrative practice and 
procedure. Fraud, Grant programs — 
health, Medicaid, and Reporting and 
recordkeeping requirements. 

For the reasons set forth in the 
preamble, the Centers for Medicare & 
Medicaid Services amends 42 CFR 
chapter IV and the Office of the 
Inspector General amends 42 CFR 
chapter V, as set forth belov^: 

CHAPTER IV— CENTERS FOR MEDICARE & 
MEDICAID SERVICES, DEPARTMENT OF 
HEALTH AND HUMAN SERVICES 

PART 405— FEDERAL HEALTH 
INSURANCE FOR THE AGED AND 
DISABLED 

■ 1, The authority citation for part 405 
continues to read as follows: 

Authority: Secs. 205(a}. 1102, 1861. 
lB62(a], 1869, 1871, 1874, 1881, and 1886(k) 
of the Social Security Act [42 U.S.C. 405(a), 
1302. 139SX, 1395y(a), 1395ff, ISOShh, 
1395kk, 1395ir and 139Sww(k)}, and sec. 3S3 
of the Public Health Service Act (42 U.S.C. 
263a). 

Subpart C — Suspension of Payment, 
Recovery of Overpayments, and 
Repayment of Scholarships and Loans 

■ 2. The authority citation for subpart C 
is revised to read as follows: 

Authority: Secs, 1102, 1615,1833,1642, 
1862, 1866, 1870, 1871,1879 and 1892 of the 
Social Security Act (42 U.S.C. 1302, 13g5g, 
13951, 13.95U, 1395y. 1395cc, 1395gg, 

1395hh. 1395pp and 139r»ccc) and 31 U.S.C. 
3711. 

■ 3. In subpart C, remove the phrase 
“intermediary or carrier” wherever it 
appears and add the phrase “Medicare 
contractor” in its place, 

■ 4. Section 405,370 is amended as 
follows: 

■ A. In paragraph (a), adding the 
definitions of “Credible allegation of 
fraud,” “Medicare contractor,” and 


“Resolution of an investigation” in 
alphabetical order. 

■ B. In paragraph (a), revising the 
definitions of “Offset,” “Recoupment,” 
and “Suspension of payment”. 

The additions and revisions read as 
follows: 

§ 405.370 Definitions. 

(aP * ' 

Credible allegation of fraud. A 
credible allegation of firaud is an 
allegation from any source, including 
but not limited to the following: 

(1) Fraud hotline complaints. 

( 2 ) Claims data mining. 

(3) Patterns identified through 
provider audits, civil False claims cases, 
and law enforcement investigations. 
Allegations are considered to be 
credible when they have indicia of 
reliability. 

Medicare contractor. Unless the 
context otherwise requires, includes, 
but is not limited to the any of 
following: 

(1) A fiscal intermediary. 

(2) A carrier. 

(3) Program safeguard contractor. 

(4) Zone program integrity contractor. 

(51 Part A/Part B Medicare 

administrative contractor. 

Offset. The recovery by Medicare of a 
non-Medicare debt by reducing present 
or future Medicare payments and 
applying the amount withheld to the 
indebtedness. (Examples are Public 
Health Service debts or Medicaid debts 
recovered by CMS). 

Recoupment. The recovery by 
Medicare of any outstanding Medicare 
debt by reducing present or future 
Medicare payments and applying the 
amount withheld to the indebtedness. 

Resolution of an investigation. An 
investigation of credible allegations of 
fraud will be considered resolved when 
legal action is terminated by settlement, 
judgment, or dismissal, or when the 
case is closed or dropped because of 
insufficient evidence to support the 
allegations of fraud. 

Suspension of payment. The 
withholding of payment by a Medicare 
contractor from a provider or supplier of 
an approved Medicare payment amount 
before a determination of the amount of 
the overpayment exists, or until the 
resolution of an investigation of a 
credible allegation of fraud. 

■ 5. Section 405.371 is revised to read 
os follows: 

§405.371 Suspension, offset, and 
recoupment of Medicare payments to 
providers end suppliers of services. 

(a) General rules. Medicare payments 
to providers and suppliers, as 


authorized under this subchapter 
(excluding payments to beneficiarios), 
may be — 

(1) Suspended, in whole or in part, by 
CMS or a Medicare contractor if CMS or 
the Medicare contractor possesses 
reliable information that an 
overpayment exists or that the payments 
to be made may not be correct, although 
additional information may be needed 
for a determination; 

(2) In cases of suspected fraud, 
suspended, in whole or in part, by CMS 
or a Medicare contractor if CMS or the 
Medicare contractor has consulted with 
the OIG, and, as appropriate, the 
Department of Justice, and determined 
that a credible allegation of fraud exists 
against a provider or supplier, unless 
there is good cause not to suspend 
payments: or 

(3) Offset or recouped, in whole or in 
part, by a Medicare contractor if the 
Medicare contractor or CMS has 
determined that tbe provider or supplier 
to whom payments are to be made has 
been overpaid, 

(b) Good cause exceptions applicable 
to paymenf suspensions, 

(1) CMS may find that good cause 
exists not to suspend payments or not 
to continue to suspend payments to an 
individual or entity against which there 
are credible allegations of fraud if — 

(1) OIG or other law enforcement 
agency has specifically requested that a 
payment suspension not be imposed 
because such a payment suspension 
may compromise or jeopaidlze an 
investigation; 

(ii) It is determined that beneficiary 
access to items or services would be so 
jeopardized by a payment suspension in 
whole or part as to cause a danger to life 
or health; 

(iii) It is determined that other 
available remedies implemented by 
CMS or a Medicare contractor more 
effectively or quickly protect Medicare 
funds than would implementing a 
payment suspension; or 

(iv) CMS determines that a payment 
suspension or a continuation of a 
payment suspension is not in the best 
interests of the Medicare program. 

(2) Every 180 days after the initiation 
of a suspension of payments based on 
credible allegations of fraud, CMS 
will — 

(i) Evaluate whether there is good 
cause to not continue such suspension 
under this section; and 

(ii) Request a certification from the 
OIG or oAor law enforcement agency 
that the matter continues to be under 
investigation warranting continuation of 
the suspension. 

(3) Good cause not to continue to 
suspend payments to an individual or 
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entity against which there are credible 
allegations of fraud must be deemed to 
exist if a payment suspension has been 
in effect for 18 months and there has not 
been a resolution of the investigation, 
except CMS may extend a payment 
suspension beyond that point if — 

(I) The case has been referred to, and 
is being considered by, the OIG for 
administrative action (for example, civil 
money penalties); or such 
administrative action is pending or 

(ii) The Department of Justice submits 
a written request to CMS that the 
suspension of payments be continued 
based on the ongoing investigation and 
anticipated filing of criminal or civil 
action or both or based on a pending 
criminal or civil action or both. At a 
minimum, the request must include the 
following; 

(A) Identification of the entity under 
suspension. 

(B) The amount of time needed for 
continued suspension in order to 
conclude the criminal or civil 
proceeding or both. 

(C) A statement of why or how 
criminal or civil action or both may be 
affected if the requested extension is not 
granted. 

(c) Steps necessary /or suspens/on o/ 
payment, offset, and recoupment. 

(1) Except as provided in paragraph 

(d) of this section, CMS or the Medicare 
contractor suspends payments only after 
it has complied with the procedural 
requirements set forth at § 405,372. 

(2) The Medicare contractor offsets or 
recoups payments only after it has 
complied with the procedural 
requirements set forth at § 405.373. 

(d) Suspension of payment in the case 
of unfiled cost reports. (1) If a provider 
has failed to timely file an acceptable 
cost report, payment to the provider is 
immediately suspended in whole or in 
part until a cost report is filed and 
determined by the Medicare contractor 
to be acceptable. 

(2) In the case of an unfiled cost 
report, the provisions of § 405.372 do 
not apply. (See § 405.372(a)(2) 
concerning failure to furnish other 
information.) 

■ 6. Section 405.372 is amended as 
follows: 

■ A. Remove the phrase “intermediary, 
carrier” wherever it appears and adding 
the phrase “Medicare contractor” in its 
place. 

■ B, Revising paragraphs (a)(4), (c), and 
(d)(3). 

■ C. in paragraph (e), removing the 
cross-reference “§ 405.371(b)” and 
adding the cross-reference “§405, 371 (a)” 
in its place. 
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§ 405.372 Proceeding for suspension of 
payment. 

!a)* • * 

(4) Fraud If the intended suspension 
of payment involves credible allegations 
of fraud under §405.371(a)(2), CMS — 

(i) In consultation with OIG and, as 
appropriate, the Department of Justice, 
determines whether to impose the 
suspension and if prior notice is 
appropriate; 

(ii) Directs the Medicare contractor as 
to the timing and content of the 
notification to the provider or supplier; 
and 

(iii) Is the real party in interest and is 
responsible for the decision. 

(c) Subsequent action. (1) If a 
suspension of payment is put into effect 
under § 405.371(a)(1), CMS or the 
Medicare contractor takes timely action 
after the suspension to obtain the 
additional information it may need to 
make a determination as to whether an 
overpayment exists or the payments 
may be made. 

(1) CMS or the Medicare contractor 
makes all reasonable efforts to expedite 
the determination. 

(ii) As soon as the determination is 
made, CMS or the Medicare contractor 
informs the provider or supplier and, if 
appropriate, the suspension is rescinded 
or any existing recoupment or offset is 
adjusted to take into account the 
determination. 

(2) {i) If a suspension of payment is 
based upon credible allegations of fraud 
in accordance with §405. 371(a)(2). 
subsequent action must be taken by 
CMS or the Medicare contractor to make 
a determination as to whether an 
overpayment exists. 

(ii) The rescission of the suspension 
and the issuance of a final overpayment 
determination to the provider or 
supplier may be delayed until 
resolution of the investigation. 

(d) • • * 

(3) Exceptions to the time Umits. (i) 
The time limits specified in paragraphs 
{d)(l) and (d)(2) of this section do not 
apply if the suspension of payments is 
based upon credible allegations of fraud 
under § 405.371(a)(2). 

(ii) Although the time limits specified 
in paragraphs (d)(l) and (d)(2) of this 
section do not apply to suspensions 
based on credible allegations of fraud, 
all suspensions of payment in 
accordance with § 405.371(a)(2) will be 
temporary and will not continue after 
the resolution of an investigation, unless 
a suspension is warranted because of 
reliable evidence of an overpayment or 
that the payments to be made may not 


be correct, as specified in 
§ 405.371(a)(1). 


PART 424— CONDITIONS FOR 
MEDICARE PAYMENT 

■ 7. The authority citation for part 424 
continues to read as follows: 

Authority: Secs. 1102 and 1871 of the 
Social Security Act {42 U.S.C. 1302 and 
1395hh). 

■ 8. Section 424.57 is amended by 
revising paragraph (e) to read as follows: 

§ 424.57 Special payment rules for items 
furnished by DMEPOS suppliers and 
issuance of DMEPOS supplier billing 
privileges. 

(e) RevaUdation of billing privileges. A 
supplier must revalidate its application 
for billing privileges every 3 years after 
the billing privileges are first granted. 
(Each supplier must complete a new 
application for billing privileges 3 years 
after its last revalidation.) 

■ 9. Section 424.502 is amended by 
adding the definition of “Institutional 
provider” in alphabetical order to read 
as follows: 

§424.502 Definitions. 

Institutional provider means any 
provider or supplier that submits a 
paper Medicare enrollment application 
using the CMS-855A, CMS-855B (not 
including physician and nonphysician 
practitioner organizations), CMS-655S 
or associated Internet-based PECOS 
enrollment application, 

■ 10. Section 424.514 is added to read 
as follows: 

§424.514 Application fee. 

(a) Applicotion fee requirements for 
prospective institutional providers. 
Beginning on or after March 25, 2011, 
prospective institutional providers that 
are submitting an initial application or 
currently enrolled institutional 
providers that are submitting an 
application to establish a new practice 
location must submit either or both of 
the following: 

(1) The applicable application fee. 

(2) A request for a hardship exception 
to the application fee at the time of 
filing a Medicare enrollment 
application. 

(b) Application fee requirements for 
revalidating institutional providers. 
Beginning March 25, 2011, institutional 
providers that are subject to CMS 
revalidation efforts must submit either 
or both of the following: 
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(1) The applicable application fee, 

(2) A request for a hardship exception 
to the application fee at the lime of 
filing a Medicare enrollment 
application. 

(c) Hardship exception for disaster 
areas. CMS will assess on a case-by-case 
basis whether institutional providers 
enrolling in a geographic area that is a 
Presidentially-declared disaster under 
the Robert T. Stafford Disaster Relief 
and Emergency Assistance Act, 42 
U.S.C. 5121-5206 {Stafford Act) should 
receive an exception to the application 
fee. 

(d) App/jcation fee. The application 
fee and associated requirements are as 
follows; 

(1) For 2010, $500.00. 

(2) For 2011 and subsequent years — 

(i) Is adjusted by the percentage 
change in the consumer price index for 
all urban consumers (all items; United 
States city average) for the 12-month 
period ending with June of the previous 
year; 

(ii) Is effective from January 1 to 
December 31 of a calendar year; 

(iii) Is based on the submission of an 
initial application, application to 
establish a new practice location or the 
submission of an application in 
response to a CMS revalidation request: 

(iv) Must be in the amount calculated 
by CMS in effect for the year during 
which the application for enrollment is 
being submitted; 

(v) Is nonrefundable. except if 
submitted with one of the following; 

(A) A request for hardship exception 
that is subsequently approved; 

(B) An application ^at is rejected 
prior to initiation of screening 
processes; 

(C) An application that is 
subsequently denied as a result of the 
imposition of a temporary moratorium; 

(e) Denial or revocation based on 
application fee. A Medicare contractor 
may deny or revoke Medicare billing 
privileges of a provider or supplier 
based on noncompliance if, in the 
absence of a written request for a 
hardship exception from the application 
fee that accompanies a Medicare 
enrollment application, the bank 
account on which the check that is 
submitted with the enrollment 
application is drawn does not contain 
sufficient funds to pay the application 
fee. 

(f) 7n/ormatJon needed for submission 
of a hardship exception request. A 
provider or supplier requesting an 
exception from the application fee must 
include witli its enrollment application 
a letter that describes the hardship and 
why the hardship justifies an exception. 


(g) Failure to submit application fee 
or hardship exception request. A 
Medicare contrartor may — 

( 1 ) Reject an enrollment application 
from a newly-enrolling institutional 
provider that, with the exceptions 
described in § 424.514(b), is not 
accompanied by the application fee or 
by a letter requesting a hardship 
exception from the application fee. 

(2) Revoke the billing privileges of a 
currently enrolled institutional provider 
that, with the exceptions described in 

§ 424.514(b), is not accompanied by the 
application fee or by a letter requesting 
a hardship exception from the 
application fee. 

{3)(i) Notwithstanding the foregoing, 
the contractor must first inform the 
provider that the application fee was not 
submitted in accordance with this 
section. 

(ii) Within 30 days after the date of 
the notification, the contractor may 
reject the application of the newly- 
enrolling institutional provider or 
revoke the billing privileges of the 
currently enrolled institutional provider 
that has not submitted the fee. 

(h) Consideration of hardship 
exception request. CMS has 60 days in 
which to approve or disapprove a 
hardship exception request. If a 
provider submits a request for hardship 
exception to the fee and the provider or 
supplier has not already submitted the 
fee consistent with provisions in 

§ 424.514(a) and (b), and the request for 
hardship exception is not approved, 
CMS notifies the provider or supplier 
that the hardship exception request was 
not approved and allows the provider or 
supplier 30 days from the date of 
notification to submit the application 
fee. 

(1) A Medicare contractor does not — 

(i) Begin processing an enrollment 
application that is accompanied by a 
hardship exception request until CMS 
has made a decision to approve or 
disapprove the hardship exception 
request; and 

(ii) Deny an enrollment application 
that is accompanied by a hardship 
exception request unless the hardship 
exception request is denied by CMS and 
the provider or supplier fails to submit 
the required application fee within 30 
days of being notified that the request 
for a hardship exception was denied. 

(2) A hardship exception 
determination made by CMS is 
appealable using § 405.874 of this 
chapter. 

■ 11. Section 424.515 is amended by 
adding a new paragraph (e) to read as 
follows: 


§424.515 Requirements for reporting 
changes and updates to, and the periodic 
revalidation of Medicare enrollment 
information. 

(e) Additional off-cycle revalidation. 
On or after March 23, 2012, Medicare 
providers and suppliers, including 
DMEPOS suppliers, may be required to 
revalidate their enrollment outside the 
routine 5-year revalidation cycle (3-year 
DMEPOS supplier revalidation cycle). 

(1) CMS will contact providers or 
suppliers to revalidate their enrollment 
for off-cycle revalidation. 

(2) As with all revalidations, 
revalidations described in this 
paragraph are conducted in accordance 
with the screening procedures specified 
at §424.518. 

■ 12. Section 424.518 is added to read 
as follows: 

§424.518 Screening levels for Medicare 
providers and suppliers. 

A Medicare contractor is required to 
screen all initial applications, including 
applications for a new practice location, 
and any applications received in 
response to a revalidation request based 
on a CMS assessment of risk and 
assignment to a level of “limited,” 
“moderate.” or “high.” 

(a) Limited categorical risk. (1) 

Limited categorical risk: Provider and 
supplier categories. CMS has designated 
the following providers and suppliers as 
“limited” categorical risk: 

(i) Physician or nonphysician 
practitioners (including nurse 
practitioners, CRNAs, occupational 
therapists, speech/language 
pathologists, and audiologists) and 
medical groups or clinics, 

(ii) Anmulatory surgical centers. 

(iii) Competitive Acquisition 
Program/Part B Vendors. 

(iv) End-stage renal disease facilities. 

(v) Federally qualified health centers. 

(vi) Histocompatibility laboratories. 

(vii) Hospitals, inducting critical 
access hospitals, Department of 
Veterans Affairs hospitals, and other 
federally owned hospital facilities. 

(viii) Health programs operated by an 
Indian Health Program (as defined in 
section 4(12) of the Indian Health Care 
Improvement Act) or an urban Indian 
organization (as defined in section 4(29) 
of the Indian Health Care Improvement 
Act) that receives funding from the 
Indian Health Service pursuant to Title 
V of the Indian Health Care 
Improvement Act. 

fix) Mammography screening centers. 

(x) Mass immunization roster billers 

(xi) Organ procurement organizations. 

(xii) Pharmacies newly eiu-olling or 
revalidating via the CMS-855B 
application. 
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(xiii) Radiation therapy centers. 

(xiv) Religious non-medical health 
care institutions. 

(xv) Rural health clinics. 

(xvi) Skilled nursing facilities. 

(2) Limited screening level: Screening 
requirements. When CMS designates a 
provider or supplier as a “limited” 
categorical level of risk, the Medicare 
contractor does all of the following; 

(i) Verifies that a provider or supplier 
meets all applicable Federal regulations 
and State requirements for the provider 
or supplier type prior to making an 
enrollment determination. 

(ii) Conducts license verifications, 
including licensure verifications across 
State lines for physicians or 
nonphysician practitioners and 
providers and suppliers that obtain or 
maintain Medicare billing privileges as 
a result of State licensure, including 
State licensure in States other than 
where the provider or supplier is 
enrolling. 

(iii) Conducts database checks on a 
pre- and post-enrollment basis to ensure 
that providers and suppliers continue to 
meet the enrollment criteria for their 
provider/supplier type. 

(b) Moderate categorica] risk. (1) 
Moderate categorica! risk: Provider and 
supplier categories. CMS has designated 
the following providers and suppliers as 
“moderate” categorical risk: 

(1) Ambulance service suppliers. 

(ii) Community mental health centers. 

(iii) Comprehensive outpatient 
rehabilitation facilities. 

(iv) Hospice organizations. 

(v) Independent clinical laboratories. 

(vi) Independent diagnostic testing 
facilities. 

(vii) Physical therapists enrolling as 
individuals or as group practices. 

(viii) Portable x*ray suppliers. 

(ix) Revalidating home health 
agencies. 

(x) Revalidating DMEPOS suppliers. 

(2) Moderate screening level: 
Screening requirements. When CMS 
designates a provider or supplier as a 
“moderate” categorical level of risk, the 
Medicare contractor does all of the 
following: 

(i) Performs the “limited” screening 
requirements described in paragraph 
(a)(2) of this section, 

(ii) Conducts an on-site visit, 

(c) High categorica] risk, (l) High 
categorica! risk: Provider and supplier 
coiegorjes. CMS has designated the 
following home health agencies and 
suppliers of DMEPOS as “high” 
categorical risk: 

(i) Prospective (newly enrolling) home 
health agencies. 

(ii) Prospective (newly enrolling) 
DMEPOS suppliers. 
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(2) High screening level: Screening 
requirements. When CMS designates a 
provider or supplier as a “high” 
categorical level of risk, the Medicare 
contractor does all of the following: 

(i) Performs the “limited” and 
“moderate” screening requirements 
described in paragraphs (a)(2) and (b)(2) 
of this section. 

(ii) (A) Requires the submission of a 
set of hngerprints for a national 
background check from all individuals 
who maintain a 5 percent or greater 
direct or indirect ownership interest in 
the provider or supplier; and 

(B) Conducts a fingerprint-based 
criminal history record check of the 
Federal Bureau of Investigation's 
Integrated Automated Fingerprint 
Identification System on all individuals 
who maintain a 5 percent or greater 
direct or indirect ownership interest in 
the provider or supplier. 

(3) Ad/ustoent in the categorica! risk. 
CMS adjusts the screening level from 
"limited" or “moderate” to “high" if any 
of the following occur; 

(i) CMS imposes a payment 
suspension on a provider or supplier at 
any time in the last 10 years. 

fii) The provider or supplier — 

(A) Has been excludedf from Medicare 
by the OIG; or 

(B) Had billing privileges revoked by 
a Medicare contractor within the 
previous 10 years and is attempting to 
establish additional Medicare billing 
privileges by — 

{!) Enrolling as a new provider or 
supplier; or 

U) Billing privileges for a new 
practice location; 

(C) Has been terminated or is 
otherwise precluded from billing 
Medicaid; 

(D) Has been excluded from any 
Federal health care program; or 

(E) Has been subject to any final 
adverse action, as defined at § 424.502. 
within the previous 10 years. 

(iii) CMS lifts a temporary 
moratorium for a particular provider or 
supplier type and a provider or supplier 
that was prevented from enrolling based 
on the moratorium, applies for 
enrollment as a Medicare provider or 
supplier at any time within 6 months 
from the date the moratorium was lifted, 

(d) Fingerprinting requ/reinents. An 
individual subject to the fingerprint- 
based criminal history record check 
requirement specified in paragraph 
(c)(2){ij)(B) of this section — 

(1) Must submit a set of fingerprints 
for a national background check. 

(i) Upon submission of a Medicare 
enrollment application: or 

(ii) Within 30 days of a Medicare 
contractor request. 


(2) In the event the individual(s) 
required to submit fingerprints under 
paragraph (c)(2) of this section fail to 
submit such fingerprints in accordance 
with paragraph (d)(1) of this section, the 
provider or supplier will have its billing 
privileges — 

(i) Denied under § 424.530(aKl); or 

(ii) Revoked under § 424.535(a)(1), 

■ 13. Section 424,525 is amended by: 

■ A. Revising paragraph (a) introductory 
text. 

■ B. Adding a new paragraph (a)(3). 

The revision ancl addition read as 

follows: 

§ 424.525 Rejection of a provider or 
supplier’s enrollment application for 
Medicare enrollment. 

(a) Reasons /or re/ection. CMS may 
reject a provider’s or supplier’s 
enrollment application for any of the 
following reasons: 

(3) The prospective institutional 
provider or supplier does not submit the 
application fee in the designated 
amount or a hardship waiver request 
with the Medicare enrollment 
application at the time of filing. 

■ 14. Section 424.530 is amended by 
adding new paragraphs (a)(9) and (a)(10) 
to read as follows: 

§424.530 Dental of enrollment in the 
Medicare program. 

(a) * * * 

(9) Application fee/hardship 
exception. An institutional provider’s or 
supplier's hardship exception request is 
not granted, and the provider or 
supplier does not submit the application 
fee within 30 days of notification that 
the hardship exception request was not 
approved, 

(10) Temporary moratorium. A 
provider or supplier submits an 
enrollment application for a practice 
location in a geographic area where 
CMS has imposed a temporary 
moratorium, 

■ 15. Section 424.535 is amended as 
follows: 

■ A. Revising paragraph (a)(6). 

■ B. Adding a new paragraph (a)(12). 

■ C. Revising paragraph (c). 

§ 424.535 Revocation of enrollment billing 
and billing privileges in the Medicare 
program. 

(а) * * * 

(б) Grounds related to provider and 
supplier screening requirements. (i)(A) 
An institutional provider does not 
submit an application fee or hardship 
exception request that meets the 
requirements set forth in § 424.514 with 
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the Medicare revalidation application: 
or 

(B) The hardship exception is not 
granted and the institutional provider 
does not submit the applicable 
application form or application fee 
within 30 days of being notified that the 
hardship exception request was denied. 

(iiKA) Either of the following occurs; 

(1) CMS is not able to deposit the full 
application amount into a government- 
owned account. 

[2] The funds are not able to be 
credited to the U.S. Treasury. 

(B) The provider or supplier lacks 
sufficient funds in the account at the 
banking Institution whoso name is 
imprinted on the check or other banking 
instrument to pay the application fee; or 

(C) There is any other reason why 
CMS or its Medicare contractor is 
unable to deposit the application fee 
into a government-owned account. 

(12) Medicaid termination, (i) 
Medicaid billing privileges are 
terminated or revoked by a State 
Medicaid Agency. 

(ii) Medicare may not terminate 
unless and until a provider or supplier 
has exhausted all applicable appeal 
rights. 

(c) Reapplying after revocation. (1) 
After a provider, supplier, delegated 
official, or authorizing official has had 
its billing privileges revoked, it is barred 
from participating in the Medicare 
program from the effective date of the 
revocation until the end of the re- 
enrollment bar, 

(2) The re-enrollment bar is a 
minimum of 1 year, but not greater than 
3 years depending on the severity of the 
basis for revocation. 

(3) CMS may waive the re-enrollment 
bar if it has revoked a provider or 
supplier under § 424.53S(a)(6}(i) based 
upon the failure of the provider or 
supplier to submit an application fee or 
a hardship exception request with an 
enrollment application upon 
revaJidation. 

■ 16. A new § 424.570 is added to read 
as follows: 

§ 424.570 Moratoria on newly enrolling 
Medicare providers and suppliers. 

(a) Temporary moratoria. (1) Genera! 
rules, (i) CMS may impose a moratorium 
on the enrollment of new Medicare 
providers and suppliers of a particular 
type or the establishment of new 
practice locations of a particular type in 
a particular geographic area, 

(il) CMS will announce the temporary 
enrollment moratorium in a Federal 


Register document that includes the 
rationale for imposition of the 
temporary enrollment moratorium. 

(iii) The temporary moratorium does 
not apply to changes in practice 
location, changes in provider or 
supplier information such as phone 
number, address or changes in 
ownership (except changes in 
ownership of home health agencies that 
would require an initial enrollment 
under §424.550). 

(iv) The temporary enrollment 
moratorium does not apply to any 
enrollment application that has been 
approved by the enrollment contractor 
but not yet entered into PECOS at the 
time the moratorium is imposed. 

(2) Imposition of a temporary 
moraiorio. CMS may impose the 
temporary moratorium if — 

(i) CMS determines that there is a 
significant potential foe fraud, waste or 
abuse with respect to a particular 
provider or supplier type or particular 
geographic area or both. CMS's 
determination is based on its review of 
existing data, and without limitation, 
identifres a trend that appears to be 
associated with a high risk of fraud, 
waste or abuse, such as a — 

(A) Highly disproportionate number 
of providers or suppliers in a category 
relative to the number of beneficiaries: 
or 

(B) Rapid increase in enrollment 
applications within a category; 

(ii) A State Medicaid program has 
imposed a moratorium on a group of 
Medicaid providers or suppliers that are 
also eligible to enroll in the Medicare 
program; 

(iii) A State has imposed a 
moratorium on enrollment in a 
particular geographic area or on a 
particular provider or supplier type or 
both; or 

(iv) CMS, in consultation the HHS 
OIG or the Department of Justice or both 
and with the approval of the CMS 
Administrator identifies either or both 
of the following as having a significant 
potential for fraud, waste or abuse in the 
Medicare program: 

(A) A particular provider or supplier 
type. 

(B) Any particular geographic area. 

(b) Duration of moratoria. A 
moratorium under this section may be 
imposed for a period of 6 months and, 
if deemed necessary by CMS, may be 
extended in 6-month increments. CMS 
will publish a document in the Federal 
Register when it extends a moratorium. 

(c) Denial o/enroi/menf; Moratoria. A 
Medicare contractor denies the 
enrollment application of a provider or 
supplier if the provider or supplier is 


subject to a moratorium as specified in 
paragraph (a) of this section. 

(d) Lifting moratoria. CMS will 
publish a document in the Federal 
Register when a moratorium is lifted, 
CMS may lift a temporary moratorium at 
any time after imposition of the 
moratorium if one of the following 
occur; 

(1) The President declares an area a 
disaster under the Robert T, Stafford 
Disaster Relief and Emergency 
Assistance Act, 42 U.S.C. 5121-5206 
(Stafford Act). 

(2) Circumstances warranting the 
imposition of a moratorium have abated 
or CMS has implemented program 
safeguards to address the program 
vulnerability. 

(3) The Secretary has declared a 
public health emergency under section 
319 of the Public Health Service Act in 
the area subject to a temporary 
moratorium. 

(4) In the judgment of the Secretary, 
the moratorium is no longer needed. 

PART 447— PAYMENT FOR SERVICES 

■ 19. The authority citation forpart 447 
continues to read as follows: 

Authority: Sec. 1102 of the Social Security 
Act (42 U.S, C. 1302), 

■ 20. A new § 447,90 is added to subpart 
A to read as follows: 

§ 447.90 FFP: Conditions related to 
pending investigations of credible 
aitegations of fraud against the Medicaid 
program. 

(a) Basis and purpose. This section 
implements section 1903(i){2)(C) of the 
Act which prohibits payment of FFP 
with respect to items or services 
furnished by an individual or entity 
with respect to which there is pending 
an investigation of a credible allegation 
of fraud except under specified 
circumstances. 

(b) Denial of FFP. No FFP is available 
with respect to any amount expended 
for an item or service furnished by any 
individual or entity to whom a State has 
failed to suspend payments in whole or 
part as required by §455.23 of this 
chapter unless — 

(1) The item or service is furnished as 
an emergency item or service, but not 
including items or services furnished in 
an emergency room of a hospital; or 

( 2 ) The State determines and 
documents that good cause as specified 
at § 455.23(e) or (f) of this chapter exists 
not to suspend such payments, to 
suspend payments only in part, or to 
discontinue a previously imposed 
payment suspension. 
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PART 455— PROGRAM INTEGRITY: 
MEDICAID 

■ 21. The authority citation for part 455 
continues to read as follows: 

Authority: Sec. 1102 of the Social Security 
Act (42 U.S.C, 1302). 

■ 22. Section 455,2 is amended by 
adding the definition of “Credible 
allegation of fraud” to read as follows: 

§455.2 Definitions. 

Credible allegation of fraud. A 
credible allegation of fraud may be an 
allegation, which has been verified by 
the State, from any source, including 
but not limited to the following: 

(1) Fraud hotline complaints. 

(2) Claims data mining, 

(3) Patterns identified through 
provider audits, civil false claims cases, 
and law enforcement investigations. 
Allegations are considered to he 
credible when they have indicia of 
reliability and the State Medicaid 
agency has reviewed all allegations, 
facts, and evidence carefully and acts 
judiciously on a case-hy-case basis. 

■ 23. Section 455.23 is revised to read 
as follows: 

§455.23 Suspension of payments in cases 
of fraud. 

(a) Basis /or suspension. (1) The State 
Medicaid agency must suspend all 
Medicaid payments to a provider after 
the agency determines there is a 
credible allegation of fraud for which an 
investigation is pending under the 
Medicaid program against an individual 
or entity unless the agency has good 
cause to not suspend payments or to 
suspend payment only in part. 

(2) The State Medicaid agency may 
suspend payments without first 
notifying the provider of its intention to 
suspend such payments. 

(3) A provider may request, and must 
be granted, administrative review where 
State law so requires. 

(b) Notice of suspension, (l) The State 
agency must send notice of its 
suspension of program payments within 
the following timeframes: 

(1) Five days of taking such action 
unless requested in writing by a law 
enforcement agency to temporarily 
withhold such notice, 

(ii) Thirty days if requested by law 
enforcement in writing to delay sending 
such notice, which request for delay 
may be renewed in writing up to twice 
and in no event may exceed 90 days. 

(2) The notice must include or 
address all of the following: 


(i) State that payments are being 
suspended in accordance with this 
provision. 

(ii) Set forth the general allegations as 
to the nature of the suspension action, 
but need not disclose any specific 
information concerning an ongoing 
investigation. 

(iii) State that the suspension is for a 
temporary period, as stated in paragraph 

(c) of this section, and cite the 
circumstances under which the 
suspension will be terminated. 

(iv) Specify, when applicable, to 
which type or types of Medicaid claims 
or business imits of a provider 
suspension is effective. 

(v) Inform the provider of the right to 
submit written evidence for 
consideration by State Medicaid 
Agency. 

(vi) Set forth the applicable State 
administrative appeals process and 
corresponding citations to State law. 

(c) Duration of suspension. (1) All 
suspension of payment actions under 
this section will be temporary and will 
not continue after either of the 
following: 

(1) The agency or the prosecuting 
authorities determine that there is 
insufficient evidence of fraud by the 
provider. 

(ii) Legal proceedings related to the 
provider’s alleged fraud are completed. 

(2) A State must document in writing 
the termination of a suspension 
including, where applicable and 
appropriate, any appeal rights available 
to a provider. 

(d) Referrals to the Medicaid fraud 
control unit. (1) Whenever a State 
Medicaid agency investigation leads to 
the initiation of a payment suspension 
in whole or part, the State Medicaid 
Agency must make a fraud referral to 
either of the following: 

(1) To a Medicaid fraud control unit 
established and certified under part 
1007 of this title; or 

(ii) In States with no certified 
Medicaid fraud control unit, to an 
appropriate law enforcement agency. 

(2) The fraud referral made under 
paragraph (d)(1) of this section must 
meet all of the following requirements: 

(i) Be made in writing and provided 
to the Medicaid fraud control unit not 
later than the next business day after the 
suspension is enacted. 

(ii) Conform to fraud referral 
performance standards issued by the 
Secretary. 

{3)(i) If the Medicaid fraud control 
unit or other law enforcement agency 
accepts the fraud referral for 
investigation, the payment suspension 
may be continued until such time as the 
investigation and any associated 
enforcement proceedings are completed. 


(ii) On a quarterly basis, the State 
must request a certification from the 
Medicaid fraud control unit or other law 
enforcement agency that any matter 
accepted on the basis of a referral 
continues to be under inve-stigation thus 
warranting continuation of the 
suspension. 

(4) If the Medicaid fraud control unit 
or other law enforcement agency 
declines to accept the fraud referral for 
investigation the payment suspension 
must be discontinued unless the State 
Medicaid agency has alternative Federal 
or State authority by which it may 
impose d suspension or makes a fraud 
referral to another law enforcement 
agency. In that situation, the provisions 
of paragraph {d)(3) of this section apply 
equally to that referral as well. 

(5) A State's decision to exercise the 
good cause exceptions in paragraphs (e) 
or (f) of this section not to suspend 
payments or to suspend payments only 
in part does not relieve the State of the 
obligation to refer any credible 
allegation of fraud as provided in 
paragraph (d)(1) of this section. 

(e) Good cause not to suspend 
payments. A State may find that good 
cause exists not to suspend payments, 
or not to continue a payment 
suspension previously imposed, to an 
individual or entity against which there 
is an investigation of a credible 
allegation of fraud if any of the 
following are applicable: 

(1) Law enforcement officials have 
specifically requested that a payment 
suspension not be imposed because 
such a payment suspension may 
compromise or jeopardize an 
investigation. 

(2) Other available remedies 
implemented by the State more 
effectively or quickly protect Medicaid 
funds, 

(3) The State determines, based upon 
the submission of wTitten evidence by 
the individual or entity that is the 
subject of the payment suspension, that 
the suspension should be removed. 

(4) Recipient access to items or 
services would be jeopardized by a 
payment suspension because of either of 
the following: 

(i) An individual or entity is the sole 
community physician or the sole source 
of essential specialized services in a 
community. 

(ii) The individual or entity serves a 
large number of recipients within a 
HRSA-designated medically 
underserved area. 

(5) law enforcement declines to 
certify that a matter continues to be 
under investigation per the 
requirements of paragraph (d)(3) of this 
section. 
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(6) The State determines that payment 
suspension is not in the best interests of 
the Medicaid program. 

(f) Good cause to suspend payment 
only in part. A State may find that good 
cause exists to suspend payments in 
part, or to convert a payment 
snspension previously imposed in 
whole to one only in part, to an 
individual or entity against which there 
is an investigation of a credible 
allegation of fraud if any of the 
following are applicable: 

(l) Recipient access to items or 
services would be jeopardized by a 
payment suspension in whole or part 
because of either of the following: 

(1) An individual or entity is the sole 
community physician or the sole source 
of essential specialized services in a 
community. 

(ii) The individual or entity serves a 
large number of recipients within a 
HRSA-designated medically 
underserved area. 

(2) The State determines, based upon 
the submission of written evidence by 
the individual or entity that is the 
subject of a whole payment suspension, 
that such suspension should be imposed 
only in part, 

(3) (i) The credible allegation focuses 
solely and definitively on only a 
specific type of claim or arises from 
only a specific business unit of a 
provider; and 

(ii) The State determines and 
documents in writing that a payment 
suspension in part would effectively 
ensure that potentially fraudulent 
claims were not continuing to be paid. 

(4) Law enforcement declines to 
certify that a matter continues to be 
under investigation per the 
requirements of paragraph (d)(3) of this 
section. 

(5) The State determines that payment 
suspension only in part is in the best 
interests of the Medicaid program. 

(g) Documentation and record 
retention. State Medicaid agencies must 
meet the following requirements: 

(1) Maintain for a minimum of 5 years 
from the date of issuance all materials 
documenting the life cycle of a payment 
suspension that was imposed in whole 
or part, including the following; 

(1) All notices of suspension of 
payment in whole or part. 

fii) All fraud referrals to the Medicaid 
fraud control unit or other law 
enforcement agency. 

(hi) All quarterly certifications of 
continuing investigation status by law 
enforcement. 

(iv) All notices documenting the 
termination of a suspension. 

(2) (i) Maintain for a minimum of 5 
years from the date of issuance all 
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materials documenting each instance 
where a payment suspension was not 
imposed, imposed only in part, or 
discontinued for good cause. 

(ii) This type of documentation must 
include, at a minimum, detailed 
information on the basis for the 
existence of the good cause not to 
suspend payments, to suspend 
payments only in part, or to discontinue 
a payment suspension and, where 
applicable, must specify how long the 
State anticipates such good cause will 
exist. 

(3) Annually report to the Secretary 
summary information on each of 
following: 

(i) Suspension of payment, including 
the nature of the suspected fraud, the 
basis for suspension, and the outcome of 
the suspension. 

(ii) Situation in which the State 
determined good cause existed to not 
suspend payments, to suspend 
payments only in part, or to discontinue 
a payment suspension as described in 
this section, including describing the 
nature of the suspected fraud and the 
nature of the good cause. 

■ 24. Section 455.101 is amended by 
adding the definitions of “Health 
insuring organization (HIO),” “Managed 
care entity (MCE),” “Prepaid ambulatory 
health plan (PAHP),” “Prepaid inpatient 
health plan (PIHP),” “Primary care case 
manager (PCCM),” and “Termination” in 
alphabetical order to read as follows; 

§4SS.101 Definitions. 

Health insuring organization (WO) 
has the meaning specified in § 438.2. 

Managed care entity (MCE) means 
managed care organizations (MCOs), 
PIHPs, PAHPs, PCCMs, and HIOs. 

Prepaid ambulatory health plan 
(PAHP) has the meaning specified in 
§438.2. 

Prepaid inpatient health plan (PIHP) 
has the meaning specified in §436.2. 

Primary care cose manager (PCCM) 
has the meaning specified in § 438.2. 

Terminafion means — 

(l) For a — 

(i) Medicaid or CHIP provider, a State 
Medicaid program or CHIP has taken an 
action to revoke the provider’s billing 
privileges, and the provider has 
exhausted all applicable appeal rights or 
the timeline for appeal has expired; and 

(ii) Medicare provider, supplier or 
eligible professional, the Medicare 
program has revoked the provider or 
supplier’s billing privileges, and the 
provider has exhausted ail applicable 


appeal rights or the timeline for appeal 
has expired. 

(2}{i) In all three programs, there is no 
expectation on the part of the provider 
or supplier or the State or Medicare 
program that the revocation is 
temporary. 

(ii) The provider, supplier, or eligible 
professional will be required to reenroll 
with the applicable program if they 
wish billing privileges to be reinstated, 

(3) The requirement for termination 
applies in cases where providers, 
suppliers, or eligible professionals were 
terminated or had their billing 
privileges revoked for cause which may 
include, but is not limited to — 

(i) Fraud: 

(ii) Integrity; or 

(iii) Quality. 

■ 25. Section 455.104 is revised to read 
as follows; 

§ 455.104 Disclosure by Medicaid 
providers and fiscal agents: information on 
ownership and conlroi. 

(a) Who must provide disclosures. The 
Medicaid agency must obtain 
disclosures from disclosing entities, 
fiscal agents, and managed care entities. 

(b) M^af disclosures must be 
provided. The Medicaid agency must 
require that disclosing entities, fiscal 
agents, and managed care entities 
provide the following disclosures: 

(1) (i) The name ana address of any 
person (individual or corporation) with 
an ownership or control interest in the 
disclosing entity, fiscal agent, or 
managed care entity. The address foe 
corporate entities must include as 
applicable primacy business address, 
every business location, and P.O. Box 
address. 

(ii) Date of birth and Social Security 
Number (in the case of an individual). 

(iii) Other tax identification number 
(in the case of a corporation) with an 
ownership or control interest In the 
disclosing entity (or hscal agent or 
managed care entity) or in any 
subcontractor in which the disclosing 
entity (or fiscal agent or managed care 
entity) has a 5 percent or more interest, 

(2) Whether the person (individual or 
corporation) with an ownership or 
control interest in the disclosing entity 
(or fiscal agent or managed care entity) 
is related to another person with 
ownership or control interest in the 
disclosing entity as a spouse, parent, 
child, or sibling; or whether the person 
(individual or corporation) with an 
ownership or control interest in any 
subcontractor in which the disclosing 
entity (or fiscal agent or managed care 
entity) has a 5 percent or more interest 
is related to another person with 
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ownership or control interest in the 
disclosing entity as a spouse, parent, 
child, or sibling. 

(3) The name of any other disclosing 
entity (or fiscal agent or managed care 
entity) in which an owner of the 
disclosing entity (or fiscal agent or 
managed care entity) has an ownership 
or control interest. 

(4) The name, address, date of birth, 
and Social Security Number of any 
managing employee of the disclosing 
entity (or fiscal agent or managed care 
entity). 

(c) When the disclosures must be 
provided. 

(l) Disclosures from providers or 
disclosing entities. Disclosure from any 
provider or disclosing entity is due at 
any of the following times; 

(1) Upon the provider or disclosing 
entity submitting the provider 
application. 

(ii) Upon the provider or disclosing 
entity executing the provider agreement. 

(iii) Upon request of the Medicaid 
agency during the re-validation of 
enrollment process under § 455.414. 

(iv) Within 35 days after any change 
in ownership of the disclosing entity. 

(2) Disclosures from fiscal agents. 
Disclosures from fiscal agents are due at 
any of the following times: 

fi) Upon the fiscal agent submitting 
the proposal in accordance with the 
State’s procurement process. 

(ii) Upon the Hscai agent executing 
the contract with the State. 

(iii) Upon renewal or extension of the 
contract, 

(iv) Within 35 days after any change 
in ownership of the fiscal agent. 

(3) Disclosures from managed care 
entities. Disclosures from managed care 
entities (MCOs, PIHPs, PAHPs, and 
HIOs), except PCCMs are due at any of 
the following times; 

(i) Upon the managed care entity 
submitting the proposal in accordance 
with the State’s procurement process. 

(ii) Upon the managed care entity 
executing the contract with the State, 

(iii) Upon renewal or extension of the 
contract. 

(iv) Within 35 days after any change 
in ownership of the managed care 
entity. 

(4) Disclosures from PCCMs. PCCMs 
will comply with disclosure 
requirements under paragraph (c)(1) of 
this section. 

(d) To whom must tbs disclosures be 
provided. All disclosures must be 
provided to the Medicaid agency. 

(e) Consequences for failure to 
provide required disclosures. Federal 
financial participation (FFP) is not 
available in payments made to a 
disclosing entity that fails to disclose 


ownership or control information as 
required by this section. 

■ 26. A new subpart E is added to part 
455 to road as follows: 

Subpar! E — Provider Screening and 
Enrollment 

Sec. 

455.400 Purpose. 

455.405 State plan requirements. 

455.410 Enrolhnent and screening of 
providers. 

455.412 Verification of provider licenses. 
455.414 Rovalidafion of enrollment 
455.416 Termination or denial of 
enrollment. 

4S5.420 Reactivation of provider 
enrollment. 

455.422 Appeal rights. 

453.432 Site visits. 

455.434 Criminal background checks. 
4SS.436 Federal database checks. 

455.440 National Provider Identifier. 
455.450 Screening levels for Medicaid 
providers. 

455.452 Other State screening methods. 
455.460 Application fee. 

455.470 Temporary moratoria. 

Subpart E — Provider Screening and 
Enrollment 

§455.400 Purpose. 

This subpart implements sections 
1866(j). 1902(a)(39). 1902(a)(77). and 
1902(a)(78) of the Act. It sets forth State 
plan requirements regarding the 
following: 

(a) Provider screening and enrollment 
requirements. 

(b) Fees associated with provider 
screening. 

(c) Temporary moratoria on 
enrollment of providers. 

§ 455.405 State plan requirements. 

A State plan must provide that the 
requirements of§455.410 through 
§ 455.450 and §455.470 are met. 

§455.410 Enrolment and screening of 
providers. 

(a) The State Medicaid agency must 
require all enrolled providers to be 
screened under to this subpart. 

(b) The State Medicaid agency must 
require all ordering or referring 
physicians or other professionals 
providing services under the State plan 
or under a waiver of the plan to be 
enrolled as participating providers. 

(c) The State Medicaid agency may 
rely on the results of the provider 
screening performed by any of the 
following; 

(1) Medicare contractors. 

(2) Medicaid agencies or Children's 
Health Insurance Programs of other 
States. 

§455.412 Verification of provider licenses. 
The State Medicaid agency must — ' 


(a) Have a method for verifying that 
any provider purporting to be licensed 
in accordance with the laws of any State 
is licensed by such State. 

(b) Confirm that the provider’s license 
has not expired and that there are no 
current limitations on the provider’s 
license. 

§455.414 Pevaiidation of enrollment. 

The State Medicaid agency must 
revalidate the enrollment of all 
providers regardless of provider type at 
least every 5 years. 

§455.416 Termination or denial of 
enrollment. 

The State Medicaid agency — 

(a) Must terminate the enrollment of 
any provider where any person with a 
5 percent or greater direct or indirect 
ownership interest in the provider did 
not submit timely and accurate 
information and cooperate with any 
screening methods required under this 
subpart. 

(b) Must deny enrollment or terminate 
the enrollment of any provider where 
any person with a 5 percent or greater 
direct or indirect ownership interest in 
the provider has been convicted of a 
criminal offense related to that person’s 
involvement with the Medicare, 
Medicaid, or title XXI program in the 
last 10 years, unless the State Medicaid 
agency determines that denial or 
termination of enrollment is not in the 
best interests of the Medicaid program 
and the State Medicaid agency 
documents that determination in 
writing. 

(c) Must deny enrollment or terminate 
the enrollment of any provider that is 
terminated on or after January 1, 2011, 
under title XVIIl of the Act or under the 
Medicaid program or CHIP of any other 
State. 

(d) Must terminate the provider’s 
enrollment or deny enrollment of the 
provider if the provider or a person with 
an ownership or control interest or who 
is an agent or managing employee of the 
provider fails to submit timely or 
accurate information, unless the State 
Medicaid agency determines that 
termination or denial of enrollment is 
not in the best interests of the Medicaid 
program and the State Medicaid agency 
documents that determination in 
writing. 

(e) Must terminate or deny enrollment 
if the provider, or any person with a 5 
percent or greater direct or indirect 
ovmership interest in the provider, fails 
to submit sets of fingerprints in a form 
and manner to be determined by the- 
Medicaid agency within 30 days of a 
CMS or a State Medicaid agency 
request, unless the State Medicaid 
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agency determines that termination or 
denial of enrollment is not in the best 
interests of the Medicaid program and 
the State Medicaid agency documents 
that determination in writing. 

(f) Must terminate or deny enrollment 
if the provider fails to permit access to 
provider locations for any site visits 
under § 455.432, unless the State 
Medicaid agency determines that 
termination or denial of enrollment is 
not in the best interests of the Medicaid 
program and the State Medicaid agency 
documents that determination in 
writing. 

(g) May terminate or deny the 
provider’s enrollment if CMS or the 
State Medicaid agency — 

(1) Determines that the provider has 
falsified any information provided on 
the application; or 

(2) Cannot verify the identity of any 
provider applicant. 

§ 455.420 Reactivation of provider 
enrollment. 

After deactivation of a provider 
enrollment number for any reason, 
before the provider’s enrollment may be 
reactivated, the State Medicaid agency 
must re-screen the provider and require 
payment of associated provider 
application fees under §455.460. 

§455.422 Appeal rights. 

The State Medicaid agency must give 
providers terminated or denied under 
§455.416 any appeal rights available 
under procedures established by State 
law or regulations. 

§455.432 Site visits. 

The State Medicaid agencv — 

(a) Must conduct pre-enrollment and 
post-enrollment site visits of providers 
who are designated as “moderate” or 
“high” categorical risks to the Medicaid 
program. TTie purpose of the site visit 
will be to verify that the information 
submitted to the State Medicaid agency 
is accurate and to determine compliance 
with Federal and State enrollment 
requirements. 

[b) Must require any enrolled provider 
to permit CMS, its agents, its designated 
contractors, or the State Medicaid 
agency to conduct unannounced on-site 
inspections of any and all provider 
locations. 

§455-434 Criminal background checks. 

The State Medicaid agencw — 

(a) As a condition of enrollment, must 
require providers to consent to criminal 
background checks including 
fingerprinting when required to do so 
under State law or by the level of 
screening based on risk of fraud, waste 
or abuse as determined for that category 
of provider. 


lb) Must establish categorical risk 
levels for providers and provider 
categories who pose an increased 
financial risk of fraud, waste or abuse to 
the Medicaid program. 

(1) Upon the State Medicaid agency 
determining that a provider, or a person 
with a 5 percent or more direct or 
indirect ownership interest in the 
provider, meets the State Medicaid 
agency’s criteria hereunder for criminal 
background checks as a “high" risk to 
the Medicaid program, the State 
Medicaid agency will require that each 
such provider or person submit 
fingerprints. 

(2) The State Medicaid agency must 
require a provider, or any person with 
a 5 percent or more direct or indirect 
ownership interest in the provider, to 
submit a set of fingerprints, in a form 
and manner to be determined by the 
State Medicaid agency, within 30 days 
upon request fi-om CMS or the State 
Medicaid agency. 

§ 455.436 Federal database checks. 

The State Medicaid agency must do 
all of the following: 

(a) Confirm the identity and 
determine the exclusion status of 
providers and any person with an 
ownership or control interest or who is 
an agent or managing employee of the 
provider through routine checks of 
Federal databases. 

(b) Check the Social Security 
Administration’s Death Master File, the 
National Plan and Provider 
Enumeration System (NPPES), the List 
of Excluded Individuals/Entities (LEIE), 
the Excluded Parties List System 
(EPLS), and any such other databases as 
the Secretary may prescribe. 

(c) (1) Consult appropriate databases to 
confirm identity npon enrollment and 
reenrollment; and 

(2) Check the LEIE and EPLS no less 
frequently than monthly. 

§455.440 National Provider Identifier. 

The State Medicaid agency must 
require all claims for payment for items 
and services that were ordered or 
referred to contain the National Provider 
Identifier (NPI) of the physician or other 
professional who ordered or referred 
such items or services. 

§455.450 Screening levels for Medicaid 
providers. 

A State Medicaid agency must screen 
all initial applications, including 
applications for a new practice location, 
and any applications received in 
response to a re-enrollment or 
revalidation of enrollment request based 
on a categorical risk level of "limited,” 
“moderate,” or “high.” If a provider 


could fit within more than one risk level 
described in this section, the highest 
level of screening is applicable. 

(a) Screening _for providers designated 
as limited categorical risk. When the 
State Medicaid agency designates a 
provider as a limited categorical risk, 
the State Medicaid agency must do ail 
of the following: 

(1) Verify that a provider meets any 
applicable Federal regulations, or State 
requirements for the provider type prior 
to making an enrollment determination. 

(2) Conduct license verifications, 
including State licensure verifications 
in States other than where the provider 
is enrolling, in accordance with 
§455.412, 

(3) Conduct database checks on a pre- 
and post-enrollment basis to ensure that 
providers continue to meet the 
enrollment criteria for their provider 
type, in accordance with § 455.436. 

(b) Screening for providers designated 
as moderate categorical risk. When the 
State Medicaid agency designates a 
provider as a “moderate” categorical 
risk, a State Medicaid agency must do 
both of the following; 

(t) Perform the “limited” screening 
requirements described in paragraph (a) 
of this section. 

(2) Conduct on-site visits in 
accordance with § 455.432. 

(c) Screening for providers designated 
os high categorical risk. When the State 
Medicaid agency designates a provider 
as a ‘Tiigh” categorical risk, a State 
Medicaid agency must do both of the 
following; 

(1) Perform the “limited” and 
“moderate” screening requirements 
described in paragraphs (a) and (b) of 
this section. 

(2) (i) Conduct a criminal background 
check; and 

(ii) Require the submission of a set of 
fingerprints in accordance with 
§455,434. 

(d) Denial or termination of 
enrollnient A provider, or any person 
with 5 percent or greater direct or 
indirect ownership in the provider, who 
is required by the State Medicaid agency 
or CMS to submit a set of fingerprints 
and fails to do so may have its — 

(1) Application denied under 
§455.434; or 

(2) Enrollment terminated under 
§455.416. 

(e) Adjustment of risk level. The State 
agency must adjust the categorical risk 
level from “limited” or “moderate” to 
“high” when any of the following 
occurs: 

(1) The State Medicaid agency 
imposes a payment suspension on a 
provider based on credible allegation of 
fraud, waste or abuse, the provider has 
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an existing Medicaid overpayment, or 
the provider has been excluded by the 
OIG or another State’s Medicaid 
program within the previous 10 years. 

(2) The State Medicaid agency or CMS 
in the previous 6 months lifted a 
temporary moratorium for the particular 
provider type and a provider that was 
prevented from enrolling based on the 
moratorium applies for enrollment as a 
provider at any time within 6 months 
from the date the moratorium was lifted. 

§ 455.452 Other State screening methods. 

Nothing in this subpart must restrict 
the State Medicaid agency from 
establishing provider screening methods 
in addition to or more stringent than 
those required by this subpart. 

§455.460 Application fee. 

(a) Beginning on or after March 25, 
2011, States must collect the applicable 
application fee prior to executing a 
provider agreement from a prospective 
or re-enrolling provider other tlian 
either of the following: 

(1) Individual physicians or 
nonphysician practitioners, 

{2)(i) Providers who are enrolled in 
either of the following: 

(A) Title XVm of the Act. 

(B) Another State’s title XIX or XXI 
plan. 

(ii) Providers that have paid the 
applicable application fee to — 

[A) A Medicare contractor: or 

(B) Another State. 

(b) If the fees collected by a State 
agency in accordance with paragraph (aj 
of this section exceed the cost of the 
screening program, the State agency 
must return that portion of the fees to 
the Federal government. 

§455.470 Temporary moratoria. 

(a)[l) The Secretary consults with any 
affected State Medicaid agency 
regarding imposition of temporary 
moratoria on enrollment of new 
providers or provider types prior to 
imposition of the moratoria, in ' 
accordance with §424.570 of this 
chapter, 

(2) The State Medicaid agency will 
impose temporary moratoria on 
enrollment of new providers or provider 
types identified by the Secretary as 
posing an increased risk to the Medicaid 
program. 

{3){i} The State Medicaid agency is 
not required to impose such a 
moratorium if the State Medicaid 
agency determines that imposition of a 
temporary moratorium would adversely 
affect benefrciaries’ access to medical 
assistance, 

(ii) If a State Medicaid agency makes 
such a determination, the State 


Medicaid agency must notify the 
Secretary in writing. 

(b) (1) A State Medicaid agency may 
impose temporary moratoria on 
enrollment of new providers, or impose 
numerical caps or other limits that the 
State Medicaid agency identifies as 
having a significant potential for fraud, 
waste, or abuse and that the Secretary 
has identified as being at high risk for 
fraud, waste, or abuse. 

(2) Before implementing the 
moratoria, caps, or other limits, the 
State Medicaid agency must determine 
that its action would not adversely 
impact benefrciaries’ access to medical 
assistance. 

(3) The State Medicaid agency must 
notify the Secretary in writing in the 
event the State Medicaid agency seeks 
to impose such moratoria, including all 
details of the moratoria; and obtain the 
Secretary’s concurrence with imposition 
of the moratoria. 

(c) (1) The State Medicaid agency must 
impose the moratorium for an initial 
period of 6 months. 

(2) If the State Medicaid agency 
determines that it is necessary, the State 
Medicaid agency may extend the 
moratorium in 6-month increments. 

(3) Each time, the State Medicaid 
agency must document in writing the 
necessity for extending the moratorium. 

PART 457~-ALLOTMENTS AND 
GRANTS TO STATES 

■ 27. The authority citation for part 457 
continues to read as follows: 

Authority: Section 1102 of the Social 
Security Act {42 U.S.C. 1302). 

■ 28. Section 457.900 is amended by 
adding a new paragraph (a](2)(x) to read 
as follows: 

§457.900 Basis, scope and applicability. 



(x) Sections 1902(a)(77) and 1902(kk) 
of the Act relating to provider and 
supplier screening, oversight, and 
reporting requirements. 

■ 29. A new § 457.990 is added to 
suhpart I to read as follows: 

§ 457.990 Provider and suf^lier screening, 
oversight, and reporting requirements. 

The following provisions and their 
corresponding regulations apply to a 
State under title XXI of the Act, in the 
same manner as these provisions and 
regulations apply to a State under title 
XIX of the Act: 

(a) Part 455, Subpart E, of this 
chapter. 

(b) Sections 1902{a){77) and 1902(kk) 
of the Act pertaining to provider and 


supplier screening, oversight, and 
reporting requirements. 

PART 498— APPEALS PROCEDURES 
FOR DETERMINATIONS THAT AFFECT 
PARTIOPATiON IN THE MEDICARE 
PROGRAM AND FOR 
DETERMINATIONS THAT AFFECT THE 
PARTICIPATION OF ICFs/MR AND 
CERTAIN NFS IN THE MEDICAID 
PROGRAM 

■ 30. The authority citation for part 498 
continues to read as follows: 

Authority: Secs. 1102 and 1871 of the 
Social Security Act (42 U.S.C. 1302 and 
1395hh). 

■ 31. Section 498,5 is amended by 
adding a new paragraph (1)(4) to read as 
follows; 

§ 498.5 Appeal rights. 


(4) Scope of review. For appeals of 
denials based on § 424.530(a)(9) of this 
chapter related to temporary moratoria, 
the scope of review will be limited to 
whether the temporary moratorium 
applies to the provider or supplier 
appealing the denial. The agency’s basis 
for imposing a temporary moratorium is 
not subject to review. 

CHAPTER V-OFFICE OF INSPECTOR 
GENERAL-HEALTH CARE, DEPARTMENT 
OF HEALTH AND HUMAN SERVICES 

PART 1007— STATE MEDICAID FRAUD 
CONTROL UNITS 

■ 32. The authority citation for part 
1007 continues to read as follows; 

Authority; 42 U.S.C. 1320 and 1395hh. 

■ 33. Section 1007.9 is amended by 
adding paragraphs (e) through (g) to 
read as follows: 

§1007.9 Relationship to, and agreement 
with, the Medicaid agency. 

{e)(l) The unit may refer any provider 
with respect to which there is pending 
an investigation of a credible allegation 
of fraud under the Medicaid program to 
the State Medicaid agency for payment 
suspension in whole or part under 
§455.23 of this title, 

(2) Referrals may be brief, but must be 
in writing and include sufficient 
information to allow the State Medicaid 
agency to identify the provider and to 
explain the credible allegations forming 
the grounds for the payment 
suspension. 

(fl Any request by the unit to the State 
Medicaid agency to delay notification to 
the provider of a payment suspension 
under §455,23 of this title must be in 
writing. 
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(g) When the unit accepts or declines 
a case referred by the State Medicaid 
agency, the unit notifios the State 
Medicaid agency in writing of the 
acceptance or declination of the case. 
Catalog of Federal Domestic Assistance 
Program No. 93.776. Medical Assistance 


No. 22/Wednesday, February 2, 2011/Rules and Regulations 5971 


Program) (Catalog of Federal Domestic 
Assistance Pragrani No. 93.773, Medicare — 
Hospital Insurance: and Program No. 93.774, 
Medicare — Supplementary Medical 
Insurance Program) 


Dated: January 14, 2011. 

Donald Berwick, 

Administrator, Centers /or Medicare &■ 
Medicoid Services. 

Approved: January 21, 2011. 

Kathleen Sebelius, 

Secretary, Department of Health and Human 
Services. 

[PR Doc, 2011-1686 Filed 1-24-11; 12:15 pm| 
BILLING CODE 412(M)1-P 
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Highlights 

HighiighJs of GA011-278. a report lo 
congressional commitlees on GAO's High- 
Risk Series 


Why GAO Did This Study 

The federal government is the world’s 
largest and most complex entity, with 
about $3.5 trillion in outlays fa fiscal 
year 2010 funding a broad array of 
programs and operations, GAO 
maintains a program to focus 
attention on government operations 
that it identifies as high risk due to 
their greater vulnerabilities to fraud, 
waste, abuse, and mismanagement or 
the need for transformation to 
address economy, efficiency, or : 
effectiveness drfalenges. Since 1990, 
GAO has designated over 50 areas as 
high risk and subsequently removed 
oyer onerthird of the areas due to 
progress made. 

This, biennial update describes the 
faatus of high-risk areas listed in 2009 
and identifies any new high-risk area 
.lieedfag aitention by Congress and 
the executive br^ch. Sbliitiphs fo 
high-risk, prpbfafas offer 
;,tosaye,b 

Gse^de;tofa6VpubiiCj^^^^ 


What Remains to Be Done 

This report contafas GAP'S views on 
progress made and what renuuns to , 
be done to brfag about lasting, 
solutions foreach high-risk area. 
Perseverance by the executive 
brabcfa fa ifaplementmg.G^ , 
recommended solutions and 
cbh^ued oversight and afaion by 
Congress are essential to achieving 
progress. GAO is dedicated to , 
continue Working with Congress and 
the executive branch to help ensure . 
additional progress is made. , 

View GAO-11-278 orkeycomponents. 

: , For more information, contact J. Christopher 
Mihm at (202) 512-6806 or niihmj@gao.gov.' 


HIGH-RISK SERIES 
An Update 


What GAO Found 

In January 2009, GAO detailed 30 high-risk areas and, in July 2009, added a 
31st — Restructuring the U.S. Postal Service to Achieve Sustainable Financial 
Viability. GAO has determined that sufficient progress has been made to 
remove the high-risk designation from two areas: the DOD Personnel Security 
Clearance Program and the 2010 Census, 

• High-level attention by DOD, 0MB, and the Office of the Director of 
National InteDigence, along with consistent congressional oversight, has 
led to significant improvements in processing security clearances. For 
example, DOD processed 90 percent of all initial clearances in an average 
of 49 days in fiscal year 2010 and thus met the 60-day statutory timeliness 
objective. Furthermore, DOD has reduced the average time it takes to 
process 90 percent of initial security clearances for industry personnel 
from 129 days in 2008 to 63 days in 2010. DOD has also developed and is 
implementing quality assessment tools and has issued adjudicative 
standards for addressing incomplete investigations. 

• The Census Biueau (Bureau), with active congressional oversight, took 
steps to address problems GAO pointed out since designating fae 2010 
Census a high-risk area in March 2008. Those steps included efforts to 
control costs, better manage operatioi'is, strengthen its risk management 
activities, and enhance the testing of automated systems, The Bureau 
generally completed its data collection activities consistent with its plans 
and released the data used to apportion Congress on December 21, 2010, 
several days ahead of the legally required end-of-year deadline. 

This year, GAO is designating one new high-risk area— Interior’s Management 
of Federal Oil and Gas Resources. Interior does not have reasonable 
assurance that it is collecting its share of billions of dollars of revenue from oil 
and gas produced on federal lands and it continues to experience problems in 
hiring, training, and retaining sufficient staff to provide oversight and 
management of oil and gas operations on federM lands and waters. Further, 
Interior recently began restructuring its oil and gas program, which is 
inherently challenging, and there are many open questions about whether 
Interior has the capacity to imdertake this reorganization while carrying out 
its range of responsibilities, especially in a constrained resource environment. 

In the past 2 years, progress has been made, to varying degrees, in most areas 
that remain on GAO’s High-Risk List. Congressional oversight and legislative 
action, high-level administration attention, and efforts of the responsible 
agencies have been central to progress. For example, Congress passed Che 
Improper Payments Elimination and Recovery Act (IPERA) of 2010 to 
enliance reporting and recovering of improper payments in federal programs. 
In addition, in November 2009, the President issued Executive Order 13520, 
Reducing Improper Payments and Eliminating Waste in Federal Programs. 
Congress also passed the Weapon Systems Acquisition Reform Act of 2009, 
which requires DOD to provide more realistic cost estimates and terminate 
programs wth high cost growth. 
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WhV ArPa Is Hi2h. Risk designated Medicare as a high-risk program because its 

® complexity and susceptibility to improper payments, added to its size, 

have led to serious management challenges. In 2010, Medicare covered 47 
million elderly and disabled beneficiaries had estimated outlays of $509 
billion. Medicare had estimated improper payments of almost $48 billion in 
fiscal year 2010. However, this improper payment estimate did not include 
all of the program’s risk, since it did not include improper payments in its 
prescription drug benefit, for which the agency has not yet estimated a 
total amount. The Centers for Medicare & Medicaid Services (CMS), which 
administers Medicare, is responsible for implementing paynrent methods 
that encourage efficient service delivery, managing the program to serve 
beneficiaries and safeguard it from loss, and overseeing patient safety and 
care. CMS faces growing challenges in coming years, given the rapid 
growth expected in the number of Medicare beneficiaries and program 
spending. 


What PAO RniinH The Medicare program remains on a path that is fiscally unsustainable 

over the long term. This fiscal pressure heightens the need for CMS to 
improve Medicare’s payment methods to achieve efficiency and savings, 
and its management, program integrity, and oversight of patient care Mid 
safety. 

Reforming and refining payments. Since January 2009, CMS has 
implemented payment reforms for Medicare Advantage, and inpatient 
hospital, home health, and end-stage renal disease services, The agency 
has also begun to provide feedback to physicians on their resource use 
and is developing a value-based payment method for physician services 
that accounts for the quality and cost of care. Efforts to provide feedback 
and encourage efficiency are crucial because physician influence on tlie 
use of other services is estimated to account for up to 90 percent of health 
care spending. 

In addition, CMS has taken steps to ensure that some physician fees 
recognize efficiencies when certain services are furnished together, but 
the agency has not targeted the services with the greatest potential for 
savings. Under the budget neutrality requirement, the savings that have 
been generated have been redistributed to increase physician fees for 
other services. Therefore, GAO recommended in 2009 that Congress 
consider exempting savings from ac^usting physician fees to recognize 
efficiencies from budget neutrality to ensure that Medicare realizes these 
savings. 
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GAO’s work has also shown that payment for imaging services may benefit 
from refinements. Specifically, CMS could add more front-end approaches 
to better ensure appropriate payments, such as requiring physicians to 
obtain prior authorization from Medicare before ordering an imaging 
service. CMS also has opportunities to improve the way it adjusts 
physician payments to account for geographical differences in the costs of 
providing care in different localities. GAO has recommended that the 
agency examine and revise the physician payment localities it uses for this 
purpose by using an approach that is uniformly applied to all states and 
based on the most current data. CMS agreed to consider the 
recommendation, but was concerned about its redistributive effects. The 
agency subsequently initiated a study of physician payment locality 
adjustments. The study is ongoing and CMS has not implemented any 
change. 

Improving program management. CMS’s implementation of competitive 
bidding for medical equipment and supplies and its new Medicare 
Administrative Contractors (MAC) have progressed, with some delays, 
Congress halted the first round of competitive bidding and required CMS 
to improve its implementation. In regard to contracting reform, due to 
delays because of protests filed in connection with the procurement 
process, CMS did not meet the target that it set for 2009 and 2010 in 
transferring workload to MACs. As of December 2010, CMS transferred 
Medicare’s fee-for-service claims workload to the new MACs in all but six 
jurisdictions. For those six Jurisdictions, CMS is transferring claims 
workload in two jurisdictions, and has ongoing procurement activity in the 
remainder. Some new MACs had delays in paying providers’ claims, but 
overall, CMS’s contractors continued to meet the agency’s performance 
targets for timeliness of claims processing in 2009. 

Regarding Medicare Advantage, CMS has not complied with statutory 
requirements to mail information on plan disenroUment to beneficiaries 
but did take steps to post this information on its Web site. In addition, the 
agency took enforcement actions for inappropriate marketing against at 
least 73 organizations that sponsored Medicare Advantage plans from 
January 2006 to February 2009. 

In regard to CMS’s management of its contracting function, GAO found 
pervasive internal control deficiencies that put billions of taxpayer dollars 
at risk of improper payments or waste and recommended that CMS take 
actions to address them. Recently, CMS has taken several actions to 
address the recommendations and correct certain deficiencies we noted, 
such as revising policies and procedures, and developing a centralized 
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tracking mechanism for employee training. However, CMS has not made 
sufficient progress to complete actions to address recommendations 
related to clarifying the roles and responsibilities for implementing certain 
contractor oversight responsibilities, clearing a backlog of contracts that 
are overdue for closeout, and finishing its investigation of over $70 million 
in payments GAO questioned in 2007. 

Enhancing program integrity. New directives, implementing guidance, 
and legislation will impact CMS’s efforts to reduce improper payments in 
the next few years. The administration has issued Executive Order 13520 
on Reducing Improper Payments in 2009 and related implementing 
guidance in 2010. In addition, the Improper Payments Elimination, and 
Recovery Act of 2010 (IPERA) amended the Improper Payments 
Information Act of 2002 and established additional requirements related to 
accountability, recovery auditing, compliance and noncompliance 
determinations, and reporting. Further, the Patient Protection and 
Affordable Care Act and the Health Care and Education Reconciliation Act 
of 2010 contain provisions designed to help reduce improper payments in 
the Medicare program. 

CMS has already taken action in some areas — for example, as required by 
law, it implemented a national Medicare Recovery Audit Contractors 
(RAC) program in 2009. CMS has set a key performance measure to reduce 
improper fee-for-service and Part C payments and is developing measures 
of improper payment for Part D. CMS was not able to demonstrate 
sustained progress at reducing its fee-for-service error rate, because 
changes made to improve the methodology for measurement make current 
year estimates noncomparable to any issued before 2009. Its 2010 fee-for- 
service payment error rate of 10.5 percent will serve as the baseline for 
setting targets for future reduction efforts. However, with a 2010 Part C 
improper payment rate of 14.1 percent, the agency met its target to have 
its 2010 improper payment rate lower than 14.3 percent. For Part, D, the 
agency is working to develop a composite improper payment rate, and for 
2010 has four nonaddable estimates, with the largest being $6.4 billion. 

Other recent CMS program integrity efforts include issuing regulations, 
tightening pro\dder enrollment requirements and creating a Center for 
Program Integrity, responsible for addressing program vulnerabilities 
leading to improper payments. However, having corrective action 
processes to address the vulnerabilities that lead to improper payments is 
also important to effectively managing them. CMS did not develop an 
adequate process to address the vidnerabilities to improper payments 
identified by the RACs. 
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Further, several recommendations GAO made to improve the targeting of 
claims review for services with high rates of improper billing have not 
been addressed. Our February 2009 report indicated that Medicare 
continued to pay some home health agencies for services that are not 
medically necessary or not rendered. To help address the issue, GAO 
recommended that postpayment reviews be conducted on claims 
submitted by home health agencies with high rates of improper billing 
identified through prepayment review and that CMS require that 
physicians receive a statement of home health services beneficiaries 
received based on the physicians' certification. In addition, GAO 
recommended that CMS require its contractors to develop thresholds for 
unexplained increases in billing by providers and use them to develop 
automated prepayment controls as a way to reduce improper payments. 
CMS has not implemented these three recommendations because the 
agency indicated it had taken other actions; however, GAO believes these 
actions will not have the same effect. 

CMS’s oversight of Part D plan sponsors' programs to deter fraud and 
abuse has been limited. However, CMS has taken some actions to increase 
it. For example, CMS officials indicated that they had conducted expanded 
desk audits and were implementing an oversight strategy. 

Overseeing patient care and safety. CMS's oversight of the quality of 
nursing home care has increased significantly in recent years, but 
weaknesses remain in surveillance that could understate care quality 
problems. Under contract with CMS, states conduct surveys at nursing 
homes to help ensure compliance with federal quality standards, but a 
substantial percentage of state nursing home surveyors and state agency 
directors identified weaknesses in CMS’s survey methodology and 
guidance. In addition to these methodology and guidance weaknesses, 
workforce shortages and insufficient training, inconsistencies in the focus 
and frequency of the supervisory review of deficiencies, and external 
pressure from the nursing home industry may lead to understatement of 
serious care problems. 

CMS established the Special Facility Focus (SFF) Program in 1998 to help 
address poor nursing home performance. Tlie SFF Program is limited to 
136 homes because of resource constraints, but according to GAO’s 
estimate, almost 4 percent (580) of the roughly 16,000 nursing homes in 
tlie United States could be considered the most poorly performing. CMS's 
current approach for funding state surveys of facilities participating in 
Medicare and Medicaid is ineffective yet these surveys are meant to ensure 
that these facilities provide safe, high-quality care. GAO found serious 
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wealoiesses in CMS's ability to (1) equitably allocate more than $250 
million in federal Medicare funding to states according to their workload, 
(2) determine the extent to which funding or other factors affected states’ 
ability to accomplish their workload, and (3) guai'antee appropriate state 
contributions. These weaknesses make assessing the adequacy of funding 
difficult. 

However, CMS has implemented many recommendations that GAO has 
made to improve oversight of nursing home care. Of the 96 
recommendations made by GAO from July 1998 through March 2010, CMS 
has fully implemented 46, partially implemented 4, is taking steps to 
implement 29, did not implement 18, Examples of key recommendations 
implemented by CMS include (1) a new sun'^ey methodology to improve 
the quality and consistency of state nursing home surveys ai\d (2) new 
complaint and enforcement databases to better monitor state survey 
activities and hold nursing homes accountable for poor care. 


What Remains to Be 
Done 


CMS has not met GAO’s criteria for having the Medicare program removed 
from the High-Risk List — for example, the agency is still developing its 
Part D improper payment rate methodology and has not yet been able to 
demonstrate sustained progress in lowering its fee-for-service and Part C 
improper payment rates, CMS needs a plan with clear measures and 
benchmarks for reducing Medicare’s risk for improper payments, 
inefficient payment methods, and issues in program management and 
patient care and safety. One important step relates to how well CMS 
implements IPERA and earlier requirements to identify the causes of 
improper payments and take appropriate action on them. Identifying the 
causes of improper payments and implementing GAO’s recommendation 
to develop an adequate corrective action process to address vulnerabilities 
could strengthen CMS’s efforts to reduce improper payments. Without an 
adequate corrective action process that uses information on vulnerabilities 
identified by the agency, its contractors, and others, CMS will not be able 
to effectively address its challenges related to improper payment. CMS has 
implemented certain GAO recommendations, such as in the area of 
nursing home oversight; however, further action is needed on GAO’s 
recommendations to improve management of key activities. To refine 
payment methods to encourage efficient pro\dsion of services CMS should 
take action to 


• ensure the implementation of an effective physician profiling system; 
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• better manage payments for services, such as imaging; 

• systematically apply payment changes to reflect efficiencies achieved by 
providers when services are commonly furnished together; and 

• refine the geographic acUustment of physician payments by revising the 
physician payment localities using an approach uniformly applied to all 
states and based on current data. 

In addition, further action is needed by CMS to establish policies to 
improve contract oversight, better target review of claims for services with 
high rates of improper billing, and improve the monitoring of nursing 
homes with serious care problems. 


GAO Contact 


For additional information about this high-risk area, contact Cynthia A. 
Bascetta at (202) 512-7114 or basccttacr@gao.gov. 
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HigiiuSis 

Highlights of GAO-11-278, a report to 
congressional commiltees on GAp's High- 
Risk Series 


Why GAO Did This Study What GAO Found 

The federal goveraraent is the world’s In January 2009, GAO detailed 30 high-risk areas and, in July 2009, added a 
largest and most complex entity, with 31st — Restructuring the U.S. Postal Service to Achieve Sust ainable Financial 

about $3.5 trillion in outlays in fiscal Viability. GAO has determined that sufficient progress has been made to 
year 2010 funding a broad array of remove the high-risk designation from two areas: the DOD Personnel Security 
programs and operations. GAO ' Clearance Program and the 2010 Census, 
maintains a program to focus 

attention on government operations * High-level attention by DOD, 0MB, and the Office of the Director of 
that it identifies as high risk due to National Intelligence, along with consistent congressional oversight, has 

their greater vuhierabilities to fraud, led to significant improvements in processing security clearances. For 

waste, abuse, and mismanagement or example, DOD processed 90 percent of all initial clearances in an average 

the need for transformation to of 49 days in fiscal year 2010 and thus met the 60-day stetutory timeliness 

address economy, efficiency, or objective. Furthermore, DOD has reduced the average time it takes to 

effecth'eness challenges. Since 1990, process 90 percent of initial security clearances for industry personnel 

GAO has designated over 50 areas as from 129 days in 2008 to 63 days in 2010. DOD has also developed and is 

high risk and subsequently removed implementing quality assessment tools and has issued adjudicative 

q^r ohe-third of the areas due to standards for addressing incomplete investigations, 

progress made. , The Census Bureau (Bureau), with active congressional oversight, took 

This biennial update describes the steps to address problems GAO pointed out since designating the 2010 

status, of high-risk areas listed in 2009 Census a high-risk area in March 2008. Those steps included efforts to 

and identifies any hew high-risk area control costs, better manage operations, strengthen its risk management 

needing attention by Cbngress and activities, and enhance the testing of automated systems, The Bureau 

the executive branch. SQiutiqns.tp generally completed its data collection activities consistent with its plans 

and released the data used to apportion Congress on December 21, 2010, 
pTdqfia^^ several days ahead of the legally required end-of-year deadline, 

service to the public, and stiengthen 

i thei^eiibrmahce ahd^^a^ This year, GAO is designating one new high-risk area— Interior s Management 

?bf the liiSi gtwb^^ of Federal Oil and Gas Resources, interior does not have reasonable 

assurance that it is collecting its share of billions of dollars of revenue from oil 
and gas produced on federal lands and it continues to experience problems in 
What Remains to Be Done hiring, training, and retaiiung sufficient staff to provide oversight and 

management of oil and gas operations on federal lands and waters. Further, 

, This report contains GAp’s views oh interior recently began restructuring its oil and gas program, which is 
progress made and what remains to inherently challenging, and there are many open questions about whether 
be^done to bring luting . , Interior has the capacity to undertake tl\is reorganization while carrying out 

solutions for eachmigh-nsk area . range of responsibilities, especially in a constrained resource environment. 

Perseverance by the executive 

ferahch in implementing GAO’S In the past 2 years, progress has been made, to varying degrees, in most areas 

recommended solutions and , , that remain on GAO’s High-Risk List. Congressional oversight and legislative 

continued oversight and action by • action, high-level administration attention, and efforts of the responsible 
Congress are essentid to achieving agencies have been central to progress. For example, Congress passed the 
prpgre^, GAO is dedicated to . . . Improper Payments Elimination and Recovery Act (IPERA) of 2010 to 

cohttoue working With Congress and. enhance reporting and recovering of improper payments in federal programs, 
the executive branch to help ensure addition, in November 2009, the President issued Executive Order 13520, 

additional progress is made. Reducing Improper Payments and Eliminating Waste in Federal Programs. 

ViewGAO-H-27aorkeycomponents. • ' • Congress also passed the Weapon Systems Acquisition Reform Act of 2009, 

For more information, contact J. Christopher ' wluch requires DOD to provide more realistic cost estimates and terminate 
Mihm a( (202) 512-6806 or mihmj@gao.gov. programs with high cost growth. 
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WllV AtGS. Is HiSh Risk designated Medicaid as a high-risk program in part due to concerns 

^ ^ about tiie adequacy of fiscal oversight, which is necessary to prevent 

inappropriate program spending. Medicaid, the federal-state program that 
covered acute health care, long-term care and other services for over 65 
million low-incorae people in fiscal year 2009, consists of more than 50 
distinct state-based programs that cost the federal government and states 
an estimated $381 billion that year. The program accounts for more than 
20 percent of states’ expenditures and exerts continuing pressure on state 
budgets. The federal government matches state expenditures for most 
Medicaid services using the Federal Medical Assistance Percentage, a 
statutory formula based on each state’s per capita income, The Centers for 
Medicare & Medicaid Services (CMS) in the Department of Health and 
Human Services (HHS) is responsible for overseeing the program at the 
federal level, while the states administer their respective programs’ day-to- 
day operations. 


What GAO Found. strong federal oversight of Medicaid is warranted as the program 

continues to grow in size and cost to states and the federal government. 
For example, under the Patient Protection and Affordable Care Act 
(PPACA), the cost of the Medicaid expansion is estimated to exceed $430 
billion over the next 10 years, with the federal government responsible for 
paying over 90 percent of these increased costs. CMS will need new tools 
and resources, including more reliable data for assessing expenditures and 
measuring performance, as the law is implemented. Medicaid remains at 
high-risk due to concerns about the adequacy of fiscal oversight of this 
large, diverse, and growing program. Areas of concern include the 
following; 

Improper payments to Medicaid providers serving program 
beneficiaries. Improper payments to providers that submit inappropriate 
claims can result in substantial financial losses to states and the federal 
government. Medicaid paynrents be improper for various reasons; 
such as if payments are made for people not eligible for Medicaid or made 
for services not provided. In its 2010 agency financial report, HHS 
estimated — on the basis of individual state error rates from a saniple of 17 
states reviewed on a rotating basis each year — a national improper 
payment rate for Medicaid of 9.4 percent (with tlie federal share estimated 
at $22.5 billion) for fiscal year 2010. Certain services may be more 
susceptible to improper payments. For example, in 2009 GAO found that 
Medicaid beneficiaries and providers v-'ere involved in potentially wasteful 
or abusive purchases of controlled substances in five selected states. 
Specifically, GAO found that Medicaid paid over $2 million in controlled 
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substance prescriptions during fiscal years 2006 and 2007 that were 
written or filled by 65 medical practitioners and pharmacies barred, 
excluded, or both from federal health care programs, including Medicaid. 
GAO recommended that CMS issue guidance to states to Implement 
processes that better prevent payment of improper claims for controlled 
substances in Medicaid. CMS generally agreed with GAO 
recommendations; however, guidance had not been issued as of the end of 
2010 . 

Positive steps toward improving the transparency over and reducing 
improper payments have been taken in recent years, including issuance of 
Presidential Memoranda and a 2009 Executive Order, Reducing Improper 
Payments, along with the enactment of the Improper Payments 
Elimination and Recovery Act of 2010 (IPERA). CMS has also taken steps 
to address improper payments. For example, in 2010 the agency issued 
guidance to states in response to PPACA provisions requiring the 
establishment of a Recovery Audit Contractor Program for Medicaiid and 
implementation of standard prepayment edits for Medicaid claims in all 
states. In addition, CMS’s Medicaid Integrity Group was elevated and 
incorporated into the agency’s over^I program integrity program. 
However, it is too soon to assess the effectiveness of CMS’s actions and 
the activities called for in the Presidential Memoranda, Executive Order, 
and IPERA in reducing improper paynients, 

Managed care rate setting and quality of data used to set such 
rates has not been consistently reviewed by CMS. Requirements for 
Medicaid managed care rates to be actuarially sound are key safeguards in 
efforts to ensure that federal spending is appropriate. In 2010, GAO 
reported that CMS had been inconsistent in ensuring that states are 
complying with the actuaiial soundness requirements. Further, GAO found 
that CMS efforts were not sufficient to ensure the quality of the data used 
by states to set managed care rates. With limited information on data 
quality, CMS cannot ensure that states’ managed care rates are 
appropriate, which places billions of dollai's at risk for misspending. GAO 
recommended that CMS implement a mechanism to track state 
compliance with actuarial soundness requirements, clarify federal 
guidance on rate-setting reviews, and make use of information on data 
quality in overseeing states’ rate setting. HHS agreed with the 
recommendations and described efforts begun to improve CMS’s 
oversight. 
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Financing methods that are inappropriate and large supplemental 
payments that are not always transparent. Some states have 
established vjuried financing arrangements involving Medicaid 
supplemental payments that inappropriately increase federal Medicaid 
matching payments. Subject to certain requirements, states may make 
supplemental payments to Medicaid providers that are separate from and 
in addition to standard state Medicaid payments for services. In fiscal year 
2010, states made more than $31 billion in supplemental payments; the 
federal share was more than $19 billion. GAO and others have reported 
concerns with states’ Medicaid supplemental payments over the last 
decade, including the use of supplemental payment arrangements to 
increase federal funding without a commensurate increase in state 
funding. 

A variety of federal legislative and CMS actions have helped curb 
inappropriate arrangements, but gaps remain. In 2003 CMS began an 
initiative to closely review state supplemental payments and required 
states to end those it found inappropriate, however, in 2008, GAO reported 
that CMS had not reviewed all supplemental payment arrangements to 
ensure payments were appropriate and for Medicaid purposes. In 2009, 
GAO found that ongoing federal oversight of supplemental payments was 
warranted in part because states’ Medicaid supplemental payments to 
certain hospitals through Disproportionate Share Hospital (DSH) 
payments for uncompensated hospital care did not account for other 
Medicaid payments the hospitals had received. In 2011, improved 
transparency and accountability requirements will go into effect for state 
DSH payments, including standards for state calculations of DSH payment 
limits, state reporting of DSH payments on a facility basis, and 
independent auditing of state DSH paynicnt reports and calculations. 
Similar standards for calculating and reporting of other types of Medicaid 
supplemental payments, such as non-DSH supplemental payments made 
under the Medicaid upper payment limit, have not been established. 

Congress has capped overall federal expenditures for DSH payments and 
created a hospital DSH payment limit that caps DSH payments to 
individual hospitals. And under the Patient Protection and Affordable Care 
Act (PPACA), reductions to DSH allocations to states in future years will 
occur. Similar limits have not been established for non-DSH supplemental 
payments, which appear to be increasing in amounts, In 2006 states 
reported making $6.3 billion (federal share $3.7 billion) in non-DSH 
supplemental payments, but not all states were reporting their payments, 
By 2010 this amount had grown to $14 billion (federal share $9.6 billion) in 
non-DSH supplemental payments; however, according to CMS officials 
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reporting is likely incomplete. Some key GAO recommendations aimed at 
improving federal oversight of non-DSH payments have not yet been 
implemented. GAO has recommended, among other things, that CMS 
establish uniform guidance for states setting forth acceptable methods for 
calculating payment amounts, require facility specific reporting of 
supplemental payments and develop a strategy to ensure all state 
supplemental payment arrangements have been reviewed. 

Demonstrations that inappropriately increase federal costs. HHS 
has authority to waive certain statutory provisions to allow states to 
implement demonstrations that test ideas for achieving program 
objectives. By policy, demonstrations should not increase federal costs. 
However, GAO reported in 2008 that HHS had approved two state 
demonstrations that could increase the federal financial liability 
substantially. At the time of our work in 2007, HHS disagreed with our 
recommendation to improve the demonstration review process through 
steps such as clarifying the criteria for reviewing and approving states’ 
proposed spending limits and ensuring that valid methods were used to 
demonstrate budget neutrality. Consequently, we elevated this 
recommendation to the Congress for consideration. HHS subsequently 
reported taking steps, such as monitoring the budget neutrality of ongoing 
demonstrations, to improve its oversight. However, no changes are 
planned in the approval process and methods used to determine budget 
neutrality of demonstrations to ensure that demonstrations do not 
increase the federal financial hability, 


What Remains to Be 
Done 


Congress, HHS and CMS have taken steps to improve the fiscal integrity of 
Medicaid, <ind CMS has implemented certain GAO recommendations, such 
as improving the information collected on certain supplemental payments. 
More federal oversight of Medicaid's fiscal and program integrity is 
needed, however, in addition to state actions. For example, CMS needs to 
ensure states develop adequate corrective action processes to address 
vulnerabilities to improper Medicaid payments to providers, and issue 
guidance to states to better prevent payment of improper claims for 
controlled substances in Medicaid. States also have key roles in reducing 
improper payments to providers in developing, implementing, and 
evaluating the effectiveness of corrective plans to reduce improper 
payments. 


CMS should also continue taking steps to improve oversight of Medicaid 
managed care payment rate-setting and Medicaid supplemental payments. 
CMS needs to identify and review the appropriateness of all Medicaid 
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supplemental payment arrangements; establish guidance to states on 
appropriate methods for calculating non-DSH Medicaid supplemental 
payments; improve reporting on non-DSH supplemental payments, and 
ensure that states account for all Medicaid payments when calculating 

DSH payment limits for payments to hospitals for uncompensated care. 

GAO Contact 

For additional information about this high-risk area, contact Katherine M. 
Iritani at (202) 512-7114 or iritanik@gao.gov. 
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